Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger describes access control as the constraints on who or what can perform an action or reach a resource in an application, and calls broken access controls a commonly encountered and often critical vulnerability. The article states that...
PortSwigger's documentation describes how Burp Scanner can be used alongside manual testing, letting testers right-click a specific request in Proxy > HTTP history and run a targeted scan that often takes only seconds rather than scanning the whole...
PortSwigger's guidance describes mapping an application's visible attack surface - the endpoints explicitly used by the domains under test - before auditing, and recommends setting an initial test scope first. Burp Suite Professional users start an...
PortSwigger describes using Burp Intruder to find hidden in-scope hosts by sending requests to the same IP address while varying the Host header to reach different back-end systems. The walkthrough uses the deliberately vulnerable portswigger-labs.net...
PortSwigger's documentation describes Burp Suite Professional's automated content discovery tool, which guesses hidden directories, files, and endpoints using lists of common names and a naming scheme derived from resources already identified. The tool...
PortSwigger's documentation notes that applications often contain locations users cannot browse to because they are not directly linked from visible content. Burp Suite includes tools intended to help discover this hidden content, letting testers build a...
PortSwigger notes that misconfiguration can leave websites supporting additional HTTP methods useful to an attacker, and that some sites ignore the method entirely and respond the same way to an arbitrary, non-standard method. The most reliable way to...
PortSwigger's guidance on scoping a website audit states that dynamic URLs generally take more effort to audit than static ones, and that effort rises as a site contains more parameters. It describes Burp features for estimating that effort, including the...
PortSwigger describes using Burp Intruder's Character frobber and Bit flipper payload types to modify each character or bit position of a token in turn, so testers can identify which parts of the token affect the response. The guidance notes that if a...
PortSwigger describes how Burp Suite's Inspector and Decoder tools handle opaque, non-human-readable data during attack surface analysis, automatically decoding formats such as URL and Base64 and letting analysts edit the decoded text to see how the...
PortSwigger's guidance describes using Burp Suite's Target site map and Proxy HTTP history to identify high-risk functionality while browsing a target website, so the tester can plan how to audit the application. It points to the deliberately vulnerable...
PortSwigger describes hidden inputs as HTTP headers, cookies, or parameters that affect how a site responds but are not used during normal interaction, and says its Param Miner extension finds them by guessing candidates from a built-in wordlist and scope...
PortSwigger's tutorial describes using Burp Suite's Repeater, Comparer, Scanner, and Intruder tools to evaluate user-controllable inputs after functionality worth investigating is found, with the goal of determining which inputs matter most to an...
PortSwigger published a set of tutorials on using Burp Suite's automated and manual tools within a penetration testing workflow, last updated November 11, 2026. The tutorials can be completed as stand-alone exercises or selected individually to learn how...
PortSwigger's documentation for the Burp's browser settings page describes a Store browser data checkbox that controls whether Burp's browser keeps settings and history in a specified folder, with a Clear all option to delete past data. It also documents...
PortSwigger's documentation describes a Burp Suite setting that controls where the scanner stores temporary files, defaulting to the platform's temporary directory unless a custom location is specified. It notes that on macOS the operating system can clear...
PortSwigger's Burp Suite documentation describes a Startup behavior tab that controls the default state of two startup wizard settings: Pause Automated Tasks, which stops automated tasks from sending requests when Burp opens, and Trust this project, which...
PortSwigger runs two release channels for Burp Suite, Early Adopter and Stable, with new features appearing first on the early adopter channel and moving to stable after a couple of weeks once the company is confident there are no unforeseen issues. By...
PortSwigger's documentation describes the session handling rule editor in Burp Suite, opened via Settings > Sessions > Session handling rules, which lets users add or edit rules across two tabs. Each rule contains one or more actions that Burp performs in...
PortSwigger's documentation describes response extraction rules in Burp, which define where in an HTTP response a varying item sits so it can be pulled out consistently across multiple responses. The rules are used to identify a custom session token in...
PortSwigger's documentation for Burp Collaborator settings explains that Collaborator is an external service Burp uses to discover vulnerabilities such as external service interaction and out-of-band XSS. The public Collaborator server currently uses the...
PortSwigger's Burp Scanner can run focused scans on specific HTTP messages selected from tools that display HTTP traffic, such as the Site map and HTTP history tabs. Users right-click selected entries and choose either a passive scan, which analyzes the...
PortSwigger's Burp Scanner crawls and audits web applications from one or more start URLs using a built-in Chromium browser that interacts with the application as a user would. A Broken Access Control false positive reduction feature uses AI to analyze...
PortSwigger's documentation describes how Burp Suite Professional configures and runs web application scans, automatically cataloging and analyzing an application's structure and traffic, including any REST, SOAP, and GraphQL APIs it discovers. All...
PortSwigger's documentation for Burp Suite Professional describes how the Scan details section of the scan launcher sets what Burp Scanner will crawl, starting from one or more configured start URLs and following links from them. By default the crawl scope...
PortSwigger's Burp Scanner includes a Live crawl view tab that shows a rendered view of the page the scanner is currently crawling, as it would normally appear in a browser. The documentation, last updated November 11, 2026, says the view helps users...
PortSwigger's Burp Scanner documentation describes an Insertion points panel in the Audit items tab that lists every insertion point for a request, including those outside the scan configuration's scope, which are labeled Skipped. The tree view groups...
PortSwigger's documentation describes how Burp Suite users can manually create issues for vulnerabilities that Burp Scanner does not detect automatically, by selecting requests or responses in Proxy HTTP history, the site map, or the message editor and...
PortSwigger's Burp Suite documentation describes resource pools as shared quotas of resources that scans and live audit tasks draw from, assigned when a task is created or defaulting to the default pool if none is selected. Tasks can be moved to a...
PortSwigger's Burp Suite lets users run multiple automated tasks at once and manage them through task execution settings, accessed via a gear icon on the Tasks panel of the Burp Dashboard. Tasks can be paused and resumed individually, set to start...