Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Burp Scanner now runs scan checks created by extensions alongside its built-in checks during the audit, for both web application and API-only scans. Loading an extension automatically enables its scan checks in the scan launcher, where they...
PortSwigger's Burp Suite now includes Explore Issue, an AI-powered pentesting assistant that performs automated follow-up investigations on vulnerabilities already identified by Burp Scanner, selecting Burp tools, structuring and sending requests, and...
PortSwigger's Burp Scanner now lets users run custom scan checks for web application or API-only scans, and any checks saved to the custom scan checks library are enabled automatically and run alongside built-in checks during the audit. Users can toggle...
PortSwigger's documentation describes Burp Suite Professional scan configurations as collections of settings that define how a scan runs, set from the Scan configuration tab of the scan launcher and either built new or loaded from a configuration library....
PortSwigger's Burp Suite configuration library lets users store sets of login credentials and recorded login sequences and reuse them in later scans. Users can load a saved login from the scan launcher via Select from library, save all of a scan's...
PortSwigger added AI-powered recorded login sequences to Burp Suite Professional, letting Burp use supplied credentials to log in to a target site and record the first successful attempt out of up to three. The feature handles complex authentication...
PortSwigger's documentation states that adding application logins to a Burp Scanner scan lets the scanner discover content accessible only to authenticated users, because it uses those logins when crawling an application. Two login types are available,...
PortSwigger's documentation describes how Burp Suite Professional configures authentication for API-only scans, supporting Basic authentication, bearer tokens, and API keys, with fixed or dynamic token options. When an OpenAPI definition or Postman...
PortSwigger's Burp Scanner, built into Burp Suite Professional, automatically maps the attack surface and identifies vulnerabilities in web applications and APIs, and parses any API definitions it finds during a web application scan before auditing the...
PortSwigger's troubleshooting guide for testing mobile apps with Burp Suite directs users to the Dashboard event log, where a large number of "Connection reset" or "Remote host terminated the handshake" errors may indicate TLS 1.3 compatibility issues. The...
PortSwigger's documentation describes how to route an iOS device's traffic through Burp Suite Professional by setting the proxy to listen on all interfaces, configuring the Wi-Fi proxy on the device, and installing the PortSwigger CA certificate so HTTPS...
PortSwigger's guide explains how to route an Android device's HTTP traffic through Burp Suite by configuring a proxy listener bound to an open port, noting that from Android 7 (Nougat) onward some steps require a rooted device. To intercept HTTPS, the user...
PortSwigger's Burp Suite now lets testers edit HTTP/2 headers and pseudo-headers as separate name and value fields in the Inspector, decoupled from HTTP/1 syntax, so they can inject colons into header names and arbitrary spaces or newlines into the method,...
Burp Suite's message editor displays HTTP/2 requests using HTTP/1-style syntax, mapping the request line to the :method and :path pseudo-headers and deriving :authority from the Host header, then reversing the process when edits are made. When converting...
PortSwigger's overview explains that HTTP/2 requests use a binary format with predetermined offsets instead of the delimiter characters HTTP/1 relies on, so newlines and colons carry no special meaning inside an HTTP/2 request. It notes that HTTP/2 header...
PortSwigger published an FAQ stating that Burp Suite's Community Edition is not being discontinued and that its features are unchanged; the only differences are how Burp Suite is installed and an updated icon. The FAQ says existing configuration migrates...
PortSwigger's system requirements page states that while most Burp Suite tasks run on a relatively low-spec machine, use cases such as running multiple scans concurrently may require significantly more power to avoid a noticeable effect on performance. It...
PortSwigger's tutorial walks through setting the target scope in Burp Suite, which tells the tool exactly which URLs and hosts to test and filters out traffic from third-party sites such as YouTube and Google Analytics. After adding the target site to...
PortSwigger's tutorial walks through launching a first automated scan in Burp Suite Professional: enter a URL in the Scan launcher, pick the Lightweight preset, and the scanner crawls the target before auditing for vulnerabilities. Lightweight scans run...
PortSwigger's tutorial walks through using Burp Repeater to resend a GET /product request with a productId parameter repeatedly, changing the value each time to compare server responses. Sending a non-integer productId caused an exception and a verbose...
PortSwigger's tutorial walks through intercepting a POST /cart request in Burp Proxy on a deliberately vulnerable practice shopping site, changing the price parameter from the item's price in cents to 1, and forwarding it so a leather jacket is added to...
PortSwigger's tutorial walks through using Burp Proxy to intercept HTTP requests and responses between Burp's browser and a target server, using a live, deliberately vulnerable website. It covers turning interception on, forwarding held requests until a...
PortSwigger's walkthrough shows how to generate an HTML report from Burp Suite Professional scan results by right-clicking the target host in the Target > Site map tab and selecting Issues > Report issues for this host. A wizard steps through options such...
PortSwigger published an interactive tutorial for getting started with the core features of Burp Suite, its suite of tools for web application security testing. The tutorial uses deliberately vulnerable labs from the Web Security Academy to give users...
PortSwigger's documentation explains that Burp's proxy listener is a local HTTP proxy server that intercepts browser traffic, and that Burp creates a single listener on port 8080 of the loopback interface by default. It instructs users to confirm the...
PortSwigger's guide describes installing Burp's CA certificate in Safari by visiting http://burpsuite while Burp runs, clicking CA Certificate to download the unique certificate, then dragging it into the Certificates folder in macOS Keychain Access. The...
PortSwigger's documentation walks through installing Burp's unique CA certificate in Firefox: with Burp running, the user visits http://burpsuite, clicks CA Certificate to download it, then imports it under Preferences > Privacy and Security > View...
PortSwigger's documentation describes how to install Burp Suite's CA certificate in Chrome on Windows so that a user's own external browser can test applications over HTTPS through Burp Proxy. The steps require confirming the proxy listener is active,...
PortSwigger's guide describes how to install Burp Suite's CA certificate in Chrome on Linux so that a user's own external browser can test applications over HTTPS through Burp Proxy. The steps require confirming the proxy listener is active and the browser...
PortSwigger published a one-minute guide for configuring Safari to route traffic through Burp Suite for manual testing with Burp Proxy. The steps cover opening Safari Preferences, going to the Advanced tab, clicking Change Settings under Proxies to open...