Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
Gareth Heyes is a PortSwigger researcher known for breaking the AngularJS sandbox and building XSS vectors, and he authored PortSwigger's XSS Cheat Sheet and the book JavaScript for Hackers. His listed papers include DOM based AngularJS sandbox escapes (11...
PortSwigger Web Security announced the appointment of Yvonne Agyei as a Non-Executive Director of its Board. Agyei spent 13 years in People Operations at Google, including roles as VP Global Benefits and VP for International HR, then three years as Chief...
PortSwigger Web Security was shortlisted in the International Business of the Year category at the UK Private Business Awards, now in their eighth year. CEO Dafydd Stuttard said the company is a small team based in the North West of England exporting to...
PortSwigger announced a scholarship initiative aimed at young women studying for A-levels and considering a tech career, combining financial support at university with paid work and extensive work placement at the company. PortSwigger said a typical...
PortSwigger, the makers of Burp Suite, officially launched the Web Security Academy in October 2019, a free and interactive web security training platform that had been in beta since a soft launch in April 2019. The company cites a rise in organizations...
PortSwigger Web Security, incorporated in 2008 and based in the North West of England, is one of 201 organizations nationally recognized with a Queen's Award for Enterprise, for excellence in International Trade. The company says its application security...
PortSwigger Web Security announced the appointment of Phil Green as a Non-Executive Director of its Board. Green, a finance professional with over 20 years of experience who served as CFO at Deliveroo and held senior positions at Amazon and Groupon, joins...
PortSwigger Web Security announced the appointment of Ollie Whitehouse, CTO of NCC Group, as a Non-Executive Director of its Board. Whitehouse, who also serves as Research and Science Adviser to the UK Government, joins as CEO Dafydd Stuttard said the...
PortSwigger Web Security announced the appointment of Gillian Kent as a Non-Executive Director of its Board. Kent spent 15 years at Microsoft, including three years as Managing Director of MSN UK, was CEO of Propertyfinder until its acquisition by Zoopla,...
PortSwigger Web Security released Burp Suite Enterprise Edition, a new product built on Burp's scanning engine that uses a pool of scanning agents the company says can grow indefinitely large. It supports scheduled, on-demand, and API-driven scanning,...
PortSwigger Web Security released Burp Suite 2.0 beta, a major upgrade whose core scanning engine has been completely rewritten to handle heavily stateful applications with complex session handling. The release adds a dynamic JavaScript analyzer for...
PortSwigger released performance upgrades to Burp Suite Professional that reduce memory usage and load times, including significantly lower Intruder memory usage and faster loading of large project files with many Repeater tabs. The update also speeds up...
PortSwigger describes a cybersecurity market where a worldwide skills gap priced smaller businesses out of expertise and automated scanning software was too expensive for most SMEs. It positions Burp Suite DAST, a fully automated version of Burp Suite, as...
PortSwigger's article describes how automated web security reporting consolidates vulnerability data onto a single dashboard, letting organizations mirror their layout and track metrics such as security posture over time, bug counts by severity, and the...
PortSwigger's page describes web security automation as a way to scan web applications for vulnerabilities quickly and automatically, arguing that a worldwide shortage of security talent makes services like penetration testing expensive and hard to scale...
PortSwigger describes Burp Suite DAST as an agent-based dynamic application security testing product in which each agent scans one website at a time and parallel scanning capacity grows with each added agent. The company says its Burp Suite Professional...
PortSwigger is marketing Burp Suite DAST, its automated web vulnerability scanner for businesses, which schedules tailored scans, automatically prioritizes issues, and produces reports from one interface. The company says the software scales from four...
PortSwigger Research describes misconfigured servers that support HTTP/2 but fail to advertise it via the ALPN field during the TLS handshake, so clients default to HTTP/1.1 and the HTTP/2 support stays hidden. The result is that testers overlook viable...
PortSwigger Research describes a mixed content vulnerability, where an application loads pages over HTTPS that in turn load other resources over unencrypted connections. An attacker positioned to view a legitimate user's traffic could record and monitor...
PortSwigger Research describes a vulnerability where an application fails to prevent users from connecting over unencrypted connections, allowing an attacker who can modify a legitimate user's traffic to rewrite HTTPS links as HTTP so the browser never...
PortSwigger Research describes an application that lets users connect over unencrypted connections, allowing an attacker positioned to view a legitimate user's traffic to record their interactions and obtain any information the user supplies. It notes that...
PortSwigger Research describes TLS (or SSL) as protecting the confidentiality and integrity of data in transit between browser and server and authenticating the server's identity, which requires the server to present a certificate valid for its hostname,...
PortSwigger Research describes how browsers, when a response lacks a Content-type header, usually analyze the response body and attempt to determine its MIME type themselves. That behavior can produce unexpected results, and if the content contains...
PortSwigger Research describes how a response with an incorrect Content-type header can cause browsers to process it in unexpected ways, and if the stated type is a renderable text-based format, the browser will usually interpret the response as that...
PortSwigger Research describes an issue where an application specifies an unrecognized character set in HTML, prompting browsers to analyze the content and guess the encoding instead. The presence of non-standard characters anywhere in the response can...
When an HTML response declares its content type but omits a character set, the browser analyzes the HTML and guesses which character set it uses, and non-standard characters anywhere in the response can cause it to interpret the content under a different...
PortSwigger Research describes the case where an HTTP response specifies multiple incompatible content types, prompting the browser to analyze the response and determine the actual MIME type itself. That behavior can produce unexpected results and, when...
PortSwigger Research notes that applications sometimes Base64-encode parameters to obfuscate them from users or to carry binary data. The presence of such encoded data may point to security-sensitive information or functionality that warrants further...
PortSwigger Research notes that browsers, including Internet Explorer, may store local cached copies of content received over HTTPS, and that sensitive data held in that cache can later be retrieved by other users with access to the same computer. The...
Burp Scanner's passive scan check reports when a publicly available OpenAPI definition is found, which describes the structure of an HTTP-based API in YAML or JSON format. PortSwigger notes that such a definition is not necessarily a vulnerability, but can...