Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Burp AT lets you create an agentic test in which the tool tests one of your sites for you, provided the site has the Use agentic testing permission. You choose between User-guided AI, where Burp AT asks for approval in the chat before running...
PortSwigger's Burp AT documentation describes how to manage agentic tests: users check progress under Agentic tests, review findings on the Issues or Discovered URLs tabs, and stop or delete tests, with a stopped test's environment shutting down only after...
PortSwigger's documentation states that running Burp AT agentic tests requires the Use agentic testing site permission, which only the built-in Administrator role holds by default. Permissions accumulate across every group a user belongs to, and no role...
PortSwigger's troubleshooting guide for Burp Suite walks users through common launch and proxy failures, including running Burp from the command line with the -jar argument and confirming that the executing Java version is 21 or later. It also covers...
PortSwigger documents a user.vmoptions file that configures standard Java Virtual Machine options for Burp Suite, such as heap size and RAM usage, and persists across upgrades unlike the default vmoptions file. The file is created by copying the default...
PortSwigger documents that Burp Suite, a Java application normally distributed through native platform installers, can also be run as a standalone .jar file from the command line using a Java Runtime Environment. Command line launch requires the user to...
PortSwigger's documentation describes how Burp Suite users can review unrequested items in the site map, which are items the live passive crawl detected but the user has not yet requested. The site map displays these items in gray, and users can group them...
PortSwigger's tutorial describes the Target > Site map tab in Burp Suite, a hierarchical tree that Burp populates automatically from sites visited through Burp's browser and from sources such as Burp Scanner. The tutorial walks through expanding a...
PortSwigger's documentation describes a Burp Suite feature that compares two site maps, color-coding added, deleted, and modified items and showing a Diff count of the minimum text edits needed to turn one response into the other. Selecting an item in one...
PortSwigger's documentation describes two approaches to application mapping in Burp Suite: manual mapping and the automated crawler. It states that the automated crawler captures navigational paths in a way that lets Burp Scanner maintain session during...
PortSwigger's documentation describes Burp Sequencer's live capture feature, which repeatedly issues a request and extracts the relevant token from the application's responses in a new results window. The results window shows a progress bar and real-time...
PortSwigger's tutorial walks through using Burp Sequencer to analyze the quality of randomness in an application's session tokens, with results shown in the Live capture window as a summary of randomness quality in the sample. PortSwigger warns that...
PortSwigger's documentation describes how Burp Repeater can manipulate and resend individual WebSocket messages and analyze the application's responses. Each Repeater tab holds the WebSocket connection used to send the message, set automatically when a...
PortSwigger's documentation describes how Burp Suite users can override global Repeater settings for an individual tab, and notes that selecting any setting on the tab-specific menu causes Repeater to ignore all global settings for that tab. Tab-specific...
PortSwigger's documentation describes how Burp Repeater opens each new HTTP or WebSocket message in its own tab, with tab header controls for creating and changing tabs. It notes that tabs can be duplicated only within a group, that a tab view toggle...
PortSwigger added custom actions to Burp Repeater, scripts that run directly from the tool to extract, analyze, and transform data, retrieve external data, modify and resend requests, and use AI features to analyze messages or generate payloads. Users can...
PortSwigger added Burp AI, an on-demand assistant inside Burp Repeater that analyzes, understands, and tests HTTP messages, and in one described case it identified the parameter controlling object access, substituted leaked user IDs in a series of...
PortSwigger added an Explainer feature to Burp Suite's Repeater that generates AI explanations for highlighted sections of HTTP requests and responses between 3 and 1000 characters, triggered by right-click or the Ctrl+E/Cmd+E hotkey. Explanations appear...
PortSwigger's documentation describes Burp Repeater as a tool for manipulating and resending individual HTTP requests and analyzing the application's responses, with notes that can be added to each tab to manage work. The page also covers Professional-only...
PortSwigger's Burp Suite documentation describes how to filter the WebSockets history in Burp, using a filter window with Settings mode and Script mode tabs. Filters only control what is displayed, so hidden items are not deleted and reappear when the...
PortSwigger documented a Burp Suite feature that lets users add custom columns to the WebSockets history table using Java-based scripts, loaded from a Bambda library or written from built-in templates. The scripts use two Montoya API objects,...
PortSwigger's Burp Suite documentation describes match and replace rules, which automatically substitute parts of HTTP and WebSocket messages as they pass through the proxy, configured under Proxy > Match and replace. Rules are listed in separate HTTP and...
PortSwigger's documentation states that each installation of Burp generates its own CA certificate, which Proxy listeners use to negotiate TLS connections, and that users can export, import, or regenerate these certificates. It warns that disclosing the...
PortSwigger's documentation describes the Proxy > Intercept tab in Burp Suite, which intercepts HTTP requests and responses sent between the browser and the target server so users can study how a website behaves. The panel lists intercepted messages in a...
PortSwigger documents how to add custom columns to Burp Suite's HTTP history table using Java-based scripts, loaded from a Bambda library or written from built-in templates. The scripts use two Montoya API objects, ProxyHttpRequestResponse and Utilities,...
PortSwigger's documentation describes the Burp Suite message editor, which displays HTTP and WebSocket messages across the suite and lets users edit and resend them in tools such as Burp Repeater and Burp Intruder. The editor offers Pretty, Raw, Hex, and...
PortSwigger's tutorial walks through using the Burp Logger tab, which displays all HTTP traffic sent between Burp's tools and target websites, including requests sent automatically by tools like Burp Scanner. It notes that Burp Scanner requests do not...
PortSwigger documents how Burp Suite users can apply Java-based scripts to create custom view filters in Logger, either by loading existing scripts from their Bambda library or writing new ones from built-in templates. Scripts are compiled and applied to...
PortSwigger's documentation describes how Burp Suite users can apply Java-based scripts, called Bambdas, as custom capture filters in Logger, either by loading existing scripts from a personal Bambda library or writing new ones from built-in templates....
PortSwigger documented how to add custom columns to the Burp Logger table using Java-based scripts, which can be loaded from a Bambda library or written from built-in templates. The scripts use two Montoya API objects, LoggerHttpRequestResponse and...