Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger is promoting an on-demand webinar titled "DAST that works the way your pentesters already do," presented by Burp Suite creator and CEO Dafydd Stuttard and Burp Suite specialist Adam Armitt. The session covers why most DAST tools break testing...
PortSwigger's Burp Scanner uses an embedded, modified Chromium browser to execute JavaScript in target applications, letting it build a fully rendered DOM and reach content that scanners unable to run JavaScript would miss. The scanner parses client-side...
PortSwigger's guide describes web vulnerability scanners as automated tools that crawl and probe web applications for common flaws such as cross-site scripting, SQL injection, and cross-site request forgery, using either passive checks or active simulated...
PortSwigger's Burp Scanner can authenticate itself into privileged areas of web applications, using a Navigation Recorder Chromium extension to record complex login sequences such as SSO and multi-step forms, which Burp Suite then stores as JSON for reuse....
PortSwigger's guide explains that APIs let software request data from other software under a strict definition, and that because APIs are consumed mainly by developers and machines, their security is often overlooked, leaving gaps that let attackers edit...
PortSwigger's Burp Scanner now includes built-in API security testing, letting users scan APIs as part of a wider web app crawl and audit or as a standalone, including uploading an API definition file directly and scanning APIs that require authentication....
Burp Scanner, the web vulnerability scanner at the core of Burp Suite Professional and Burp Suite DAST, is used by over 70,000 users across more than 16,000 organizations, according to PortSwigger. It combines an embedded Chromium browser for crawling...
PortSwigger's sample Burp Scanner report on ginandjuice.shop lists 17 issue types, including SQL injection at three points (the category parameter, a request body, and a session cookie), XML external entity injection, and reflected cross-site scripting...
PortSwigger published a set of video tutorials covering Burp Suite Professional basics, including intercepting HTTP requests and responses, resending individual requests with Burp Repeater, scanning a website with Burp Scanner, and using live tasks,...
PortSwigger's Enterprise TeamCity Plugin terms state that placing an order or checking the acceptance box is only an offer, and a contract forms when PortSwigger issues an email or web confirmation, though installing the software also binds the licensee....
PortSwigger's Burp Scanner documentation states that the scanner can handle most modern web applications, including single-page applications, but SPAs may need a custom scan configuration to be scanned accurately. It notes that SPAs often use URL fragments...
PortSwigger documents four preset scan modes in Burp Scanner, described as predefined collections of scan settings that adjust how a scan balances speed and coverage. In Burp Suite DAST, a preset scan mode can be selected for folders, subfolders, and...
PortSwigger's documentation lists Burp Scanner's built-in scan configurations, which change crawl and audit settings such as disabling JavaScript analysis checks, disabling time-based detection for blind vulnerabilities, and selecting only passive audit...
PortSwigger's documentation for Burp Scanner describes the audit-phase settings that control scan behavior in Burp Suite Professional and Burp Suite DAST, including audit accuracy, automatic session handling, redirect following, scan time limits, and...
PortSwigger published a reference guide to the most common Burp Scanner error messages, covering causes such as server rate-limiting headers, out-of-scope redirects, failed login sequence replays, unparseable API definitions, and Burp's browser failing to...
PortSwigger's Burp Scanner uses an embedded Chromium browser to navigate during both the crawl and audit phases of a scan, letting it render client-side technology that a regular crawler engine cannot. The browser executes scripts to build dynamically...
PortSwigger published a BCheck for Burp Scanner that tests for server-side prototype pollution by attempting to set the status property of Object.prototype to a specific value. The check sends an initial polluting request to JSON endpoints, forces an error...
PortSwigger published a BCheck example that runs once for each insertion point found during a crawl, appending a simple mathematical calculation to a request payload. If the response returns the answer to that calculation, Burp Scanner reports an issue...
PortSwigger published a BCheck that lets Burp Scanner use Burp Collaborator to detect SSRF by sending a request with a Collaborator interaction ID in the Referer header. If the Collaborator server receives an HTTP interaction from that request, the check...
PortSwigger is inviting users to submit custom BChecks written for Burp Scanner to a community repository on GitHub via pull request. Each submission is reviewed through a combination of automated and manual checks against published submission guidelines,...
PortSwigger's reference page documents the keywords available for writing a BCheck, the declarative scan check definition language used by Burp Scanner, with mandatory properties such as language (currently enum v2-beta) and name marked by an asterisk. The...
PortSwigger's Burp Scanner now supports recorded login sequences that let it audit content behind complex authentication such as Single Sign-On, with the Login Recorder Chrome extension required to record logins in Burp Suite DAST and optional in Burp...
PortSwigger's documentation states that Burp Scanner is sometimes unable to replay a recorded login sequence during a scan, which does not fail the scan but prevents an authenticated crawl. It lists troubleshooting steps including checking the scan's event...
PortSwigger's Burp Scanner now lets you import a recorded login sequence - a set of instructions telling the scanner how to log in - instead of supplying basic user credentials, which lets it handle complex authentication mechanisms. When running a...
PortSwigger's recorded login sequence feature lets Burp Scanner supply login details for authenticated scanning of applications with complex login mechanisms, and the company recommends using it even for sites with basic username and password...
PortSwigger's documentation states that Burp Suite Professional and Burp Suite DAST let you supply login credentials for applications with a single-step login mechanism, so Burp Scanner can audit content only authenticated users can see. The scanner starts...
PortSwigger Research describes how Burp Scanner identifies login and registration forms during crawling, adding any form that meets all of its criteria to a list. It then separates registration forms from login forms using a series of ordered criteria,...
PortSwigger's documentation describes how Burp Scanner performs authenticated scanning, letting it crawl privileged content such as user dashboards and admin panels that require a login. The scanner supports two authentication methods, login credentials...
PortSwigger's Burp Scanner can scan APIs by parsing uploaded definitions or definitions found during crawling, covering OpenAPI (JSON or YAML), SOAP WSDLs, Postman Collections in v2.1.0 format, and GraphQL APIs with introspection enabled. Each format...
PortSwigger's FAQ on API scanning with Burp Suite Professional and DAST documents how the scanner parses API definitions, noting that OpenAPI 3.2 support is provisional and that GraphQL is scanned through live endpoint introspection rather than a file...