Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
Server-side code injection occurs when an application places user-controllable data into a string that a code interpreter evaluates dynamically, letting an attacker who supplies unvalidated input alter the code and run arbitrary code on the server....
PortSwigger describes server-side code injection as occurring when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter, letting crafted input modify the executed code if the data is not...
PortSwigger describes file path manipulation vulnerabilities as arising when user-controllable data is placed into a file or URL path used on the server to access local resources, which may sit inside or outside the web root. It notes that even when an...
PortSwigger describes out-of-band resource load as a condition where an application can be induced to fetch content from an arbitrary external location and fold it into its own responses. The write-up notes this is not a vulnerability by itself and may be...
PortSwigger Research describes the HTTP PUT method, normally used to upload data saved on the server at a user-supplied URL, as a vulnerability when it is enabled. If enabled, an attacker may be able to place arbitrary, and potentially malicious, content...
PortSwigger Research describes access control as the constraints on who or what is authorized to perform actions or access resources, and states that broken access controls often present a serious security vulnerability. The text notes that such flaws can...
ASP.NET allows remote debugging of web applications when configured to do so, and by default that debugging is subject to access control and requires platform-level authentication. If an attacker can start a remote debugging session, it is likely to...
XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way, letting XML metacharacters modify the structure of the resulting XML. Depending on how the XML is used, this can...
XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner, letting an attacker supply crafted input to break out of the data context and interfere with the surrounding query's structure....
LDAP injection occurs when user-controllable data is copied unsafely into an LDAP query performed by an application, letting an attacker who injects LDAP metacharacters interfere with the query's logic. Depending on what the query does, the attacker may...
XML external entity injection occurs when applications process user-supplied XML without disabling references to external resources, which XML parsers typically support by default even though applications rarely need them. Exploiting external entities can...
PortSwigger describes file path traversal, also called directory traversal, as a vulnerability that lets attackers read files they should not have access to by supplying dot-dot-slash sequences that break out of the intended directory. The flaw arises when...
ASP.NET tracing, a debugging feature meant for development, discloses sensitive information to users when left enabled in production. Application-level tracing lets any user retrieve full details of recent requests, including those of other users,...
PortSwigger Research describes second-order SQL injection, where user-supplied data is stored by the application and later incorporated into SQL queries in an unsafe way, so detection normally requires submitting data in one location and then using another...
SQL injection lets an attacker extract an entire database from a vulnerable website, including user information, encrypted passwords, and business data, and many such vulnerabilities can be found and abused with off-the-shelf tools. PortSwigger says the...
PortSwigger describes OS command injection as a critical vulnerability that arises when an application incorporates user-controllable data into an operating system command processed by a shell interpreter, letting an attacker use shell metacharacters to...
PortSwigger is promoting an on-demand webinar titled "The Future of AppSec: PortSwigger's Vision," featuring CEO and Burp Suite creator Dafydd Stuttard discussing the problems AppSec teams face in 2025. The agenda also covers near-term product strategy...
PortSwigger's page describes CI/CD security testing through Burp Suite DAST, which scans for bugs whenever new code is committed and can be configured to halt a build when it finds certain issues. It notes a REST API for universal CI/CD integration and...
TrustFoundry, an information security and penetration testing provider in Kansas City serving clients from Fortune 100 enterprises to small startups, uses Burp Suite Professional to test customer websites. The firm cites Burp Intruder for automated...
Pentara Consulting Services, a small UK cybersecurity consultancy whose consultants are CREST registered and CISSP certified, uses Burp Suite Professional for penetration testing and compliance auditing including ISO 27001 and PCI audits. The case study...
Pablo García Perez, Head of Finance at Wayra - Telefónica's global technological innovation hub, has earned numerous bug bounties in his first two years as a self-described "non-technical" ethical hacker using Burp Suite Professional. His first paid bounty...
The European Space Agency, founded in 1975 and representing 22 member states, purchased Burp Suite DAST so its teams can automate security scanning across its web portfolio. Its CISO says the automation lets the AppSec team deliver more security where it's...
Cisco Systems, founded in 1984 and based in San Jose, California, purchased Burp Suite Professional so its security engineers could test the company's own web applications. Cisco cites Burp Intruder for automated customized attacks, Burp Suite extensions...
California Polytechnic State University, a 1901-founded school serving over 21,000 students across six colleges, purchased Burp Suite DAST to automate security scanning for its AppSec team. According to its CISO, the automation lets the team deliver more...
PortSwigger describes a 70-tester application security team using Burp AI, which is built into Burp Suite and works from the same context, requests, and workflow the testers already use. The company says using Burp AI on just two or three standard...
A PortSwigger case study describes how Microsoft penetration testers use Burp Suite, with one tester saying the tool is "not up for consideration" as an alternative. The tester describes starting with content discovery, running a full crawl and audit at...
A global hospitality provider with roughly 8,000+ properties adopted Burp Suite DAST to run concurrent automated scans across hundreds of external-facing applications, complementing existing manual testing with Burp Suite Professional. The team cited...
A global payments company with roughly 20,000 employees and operations in over 200 countries adopted Burp Suite DAST to move medium- and low-risk application testing from manual penetration tests to automation, after its pentesters were managing more than...
A PortSwigger case study presents a security tester describing hands-on use of Burp Suite tools, including Repeater as their number one tool for modifying requests, Intruder for running lists of up to 100 payloads without writing a Python script, and...
A PortSwigger case study presents a pentester describing how Burp Suite is used during discovery: walking the application in the built-in browser to populate the site map, starting a background scan almost immediately, and sending interesting endpoints to...