Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's documentation describes how Burp Intruder displays every request and response issued during an attack in a results table under the Results tab, where users can select any item to view its request and response. It notes that when an attack is...
PortSwigger's Burp Intruder does not save attacks by default because they can produce large project files, and in Burp Suite Professional the results window's top-level Save menu can write out the results table as a text file, the attack configuration as a...
PortSwigger's documentation describes two filters for managing Burp Intruder attack results: a Capture filter that controls which items Intruder captures during an attack to limit resource usage, and a View filter that controls which captured items appear...
This PortSwigger documentation page describes how to analyze Burp Intruder attack results, including copying column contents with Control-click, customizing and sorting the results table, and filtering which results are captured and displayed. It also...
PortSwigger's tutorial walks through configuring a Burp Intruder Sniper attack against the deliberately vulnerable Web Security Academy blog lab, sending a POST /login request with a payload position marked on the username parameter. Pasting a list of...
PortSwigger's documentation for Burp Intruder describes the payload types the tool can inject into a base request, from simple wordlists and runtime file reads to custom iterators that permute up to eight template positions and character substitution rules...
PortSwigger's Burp Intruder ships with built-in payload lists for generating attack payloads, usable with any payload type that takes a list of strings, and users can also load their own custom payload lists through Burp's Settings dialog. Several...
PortSwigger's documentation describes how sending a request to Burp Intruder creates a new attack tab that is automatically populated with the request's details. The tab header controls let users create new tabs and modify existing ones, including...
PortSwigger's documentation describes four Burp Intruder attack types that determine how payloads are assigned to payload positions: Sniper places each payload into each position in turn using a single payload set, Battering ram places the same payload...
PortSwigger's documentation describes how Burp Intruder opens each HTTP request in a new attack tab, inserts payloads into defined positions in the request, and sends each version to the target server. Attack configurations can be saved from the top-level...
PortSwigger's documentation describes how Burp Suite's Inspector lets users add, remove, reorder, and edit request items such as HTTP headers, and re-applies the same sequence of encodings to edited data before injecting it into the request. It also notes...
PortSwigger published a tutorial on Burp Suite's Inspector, a side-panel tool that automatically groups items from a selected request and response pair by category such as HTTP headers, cookies, and parameters. The walkthrough uses a deliberately...
PortSwigger's Burp Suite includes a "Simulate manual testing" function in its Engagement tools that sends common test payloads to random URLs and parameters at irregular intervals, generating traffic that resembles manual penetration testing. Only items...
PortSwigger's Burp Suite includes a function that generates a proof-of-concept cross-site request forgery attack for a given request, displaying the selected request in the top panel and the generated CSRF HTML in the lower panel. The generated HTML uses a...
PortSwigger's documentation describes a Burp Suite content discovery function that finds content and functionality not linked from visible pages or reachable by Burp Scanner's crawl. The discovery engine works recursively, deriving new tasks when a...
PortSwigger's DOM Invader tool now logs, modifies, and automatically resends web messages sent via postMessage() to help testers probe for DOM XSS, with the features disabled by default until Postmessage interception is switched on and the browser...
PortSwigger's DOM Invader tool includes web message settings that, when enabled, replace message origins with a fake origin starting and ending with the true domain name, letting it identify event handlers that validate origins with flawed logic or regular...
PortSwigger's DOM Invader tool includes a Prototype pollution settings panel that lets testers fine-tune how it scans for prototype pollution gadgets, including options for automatic gadget scanning on page load, a slider for properties tested per frame,...
PortSwigger's DOM Invader probes for ordinary DOM XSS sources and sinks by default, and can optionally be configured to attempt other attacks. When those settings are enabled, it automatically tries to identify sources for client-side prototype pollution...
PortSwigger's DOM Invader tool now detects client-side prototype pollution sources in the URL and in JSON objects sent via web messages, and can generate a proof of concept by adding an arbitrary property to Object.prototype for manual verification in the...
PortSwigger's DOM Invader tool can now automatically test for DOM clobbering, a technique where injecting HTML into a page manipulates the DOM to change the behavior of JavaScript on that page. The check is disabled by default to avoid interfering with a...
PortSwigger's Burp Suite documentation describes a command palette that opens with Ctrl+K or Cmd+K and filters commands as the user types, with arrow keys to navigate and Enter to run the selection. The palette surfaces recently used commands at the top...
PortSwigger's tutorial walks through manually using Burp Collaborator to test whether a target site can be induced to make a request to an arbitrary server, by inserting a Collaborator payload into the Referer header of a GET /product?productId request and...
PortSwigger's documentation describes Burp Collaborator as a tool that induces a target application to interact with an external Collaborator server, letting testers find invisible vulnerabilities that return no noticeably different response to a...
PortSwigger's Burp Suite ships with its own preconfigured browser that automatically routes in-scope traffic through Burp's proxy, so HTTPS testing works on first launch without additional setup. While a tester browses, default live tasks passively crawl...
PortSwigger describes how Burp Suite detects GraphQL requests and adds a GraphQL tab to the message editor, separating the query from the rest of the request and displaying the query and its variables in separate panels. Burp can generate introspection...
PortSwigger's tutorial explains that finding vulnerabilities in WebSockets generally involves manipulating messages in ways the application doesn't expect, such as modifying existing messages or creating new ones to deliver SQL injection or cross-site...
PortSwigger published a tutorial on manipulating WebSocket handshakes in Burp Suite, showing how to clone, modify, and resend the HTTP message that establishes a WebSocket connection using Burp Repeater. The tutorial walks through sending a message from...
PortSwigger describes clickjacking as a web security vulnerability where an attacker overlays a disguised or invisible UI layer, usually using iframes, on top of a target page so users click hidden elements while believing they are doing something else....
PortSwigger's guide describes server-side request forgery (SSRF) as a vulnerability that lets an attacker induce a server-side application to make requests to an unintended location, potentially reaching back-end systems not normally publicly available,...