Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger describes blind server-side request forgery as a vulnerability where an attacker induces an application to send HTTP requests to a specified URL but receives no response. Its documented detection method uses Collaborator to inject a domain into...
PortSwigger Research describes a method for measuring how long an application takes to time out a session: Burp Intruder issues the same request repeatedly with increasing delays set in the resource pool's "Delay between requests" option, using increments...
PortSwigger's guide describes how Burp Suite users can configure a session handling rule so the scanner or Intruder automatically logs back in when an application terminates a session, for example after suspicious input triggers a logout. The rule inspects...
PortSwigger describes using Burp Sequencer to collect a large number of session tokens and analyze them for predictability, since predictable tokens can expose sites to session hijacking. The walkthrough uses the deliberately vulnerable demo site...
PortSwigger's research page explains that session management mechanisms let servers remember users across multiple HTTP interactions without repeated re-authentication, and that flaws in how those mechanisms are managed can let an attacker access another...
XML external entity injection, or XXE, is a web security vulnerability that lets an attacker interfere with how an application processes XML data. PortSwigger states it often allows an attacker to view files on the application server's filesystem and to...
PortSwigger describes web message DOM XSS as occurring when the destination origin for a web message trusts the sender not to transmit malicious data and then passes that data into a sink unsafely. DOM Invader, pre-installed in Burp's browser but disabled...
PortSwigger's guide describes stored XSS as occurring when an application receives data from an untrusted source and includes it in later HTTP responses unsafely, with the exploit executing only when a user visits a particular location, such as a blog...
PortSwigger's guide describes reflected XSS as occurring when an application receives data in an HTTP request and includes it in the immediate response without safe handling. It walks through manual testing in Burp Repeater: note where the input is...
PortSwigger describes blind cross-site scripting as a form of stored XSS where the data exit point is inaccessible to the attacker, for example because of a lack of privileges. Its testing method uses Burp Suite to inject an XSS payload that may trigger an...
PortSwigger describes reflected input as data copied from a request and echoed into an application's immediate response, calling it a prerequisite for vulnerabilities including reflected cross-site scripting. The guidance covers using Burp Scanner in Burp...
PortSwigger describes reflected cross-site scripting as arising when an application receives data in an HTTP request and includes it in its response in an unsafe way, and notes that applications use various processing and input validation methods to block...
SQL injection is a web security vulnerability that lets an attacker interfere with the queries an application makes to its database, generally enabling them to view data they are not normally able to retrieve. An attacker may then be able to modify or...
PortSwigger describes prototype pollution as a JavaScript vulnerability that lets an attacker add arbitrary properties to global object prototypes, which user-defined objects may then inherit, giving control over properties that would otherwise be...
PortSwigger describes directory traversal, also called file path vulnerabilities, as flaws that let an attacker read arbitrary files on the server running an application, including application code and data, credentials for back-end systems, and sensitive...
PortSwigger describes a technique for exfiltrating data through asynchronous OS command injection by routing command output over an out-of-band channel to Burp Collaborator. A proof-of-concept payload such as `& nslookup...
PortSwigger describes asynchronous OS command injection as a case where an application is vulnerable to command injection but executes the command asynchronously, so the application's response shows no noticeable impact. The suggested test uses Burp...
OS command injection is a vulnerability that lets an attacker execute arbitrary operating system commands on the server running an application, and it often occurs due to inadequate input validation. PortSwigger states that OS command injection can fully...
PortSwigger Research describes how applications that rely on client-side measures to control submitted data leave significant security flaws, because the user has full control over the client. The article walks through using Burp Proxy and Burp Repeater to...
PortSwigger's Burp Intruder includes a built-in username generator that takes an input such as a name and produces candidate usernames from common patterns, returning combinations like carlos.montoya and mcarlos for the input Carlos Montoya. PortSwigger...
PortSwigger's guide describes using Burp Intruder to insert a list of candidate usernames into a login or registration form and then study the responses for behavior that reveals a valid account, such as anomalous error messages, response times, or status...
PortSwigger's guide describes credential stuffing as a brute-force attack that logs into a site using known username and password pairs collected from earlier data breaches, relying on users reusing credentials across sites. Because each account is tried...
PortSwigger's guide describes using Burp Suite to brute-force a user's password, either with a wordlist of passwords collated from previous data breaches or by testing every permutation of a character set. It notes that an alphabetical password of five...
PortSwigger's guide shows how Burp Intruder can brute-force usernames and passwords in a single attack when enumerating a valid username first isn't possible, marking both values as payload positions and pasting in wordlists. It notes that running this...
PortSwigger's guidance states that websites use a range of authentication mechanisms to verify user identity, and that vulnerabilities in these mechanisms can let an attacker gain access to another user's account. It notes that such access can expose...
PortSwigger's tutorial shows how Burp Proxy's match and replace rules can automatically add or modify headers on every request made through Burp's browser, and demonstrates spoofing an IP address by injecting a custom header the server trusts. In the...
PortSwigger's guide describes Insecure Direct Object References (IDORs) as access control vulnerabilities where an application uses user-supplied input to reach files, directories, or database records directly, letting attackers manipulate those references...
PortSwigger's guide describes testing an application's access controls by holding credentials for both a high-privileged and a low-privileged account and comparing what each can reach. It covers a quick manual check in Burp Repeater using the...
PortSwigger Research describes sites that base access controls on request parameters, such as a role_id value that determines whether a user is treated as having admin privileges in the response. It notes these parameters may not bypass server-side...
PortSwigger's guidance describes testing horizontal access controls by obtaining credentials for two accounts with identical privileges and swapping the second user's session cookie into requests made as the first user. It notes that testing many endpoints...