Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's documentation explains that using Chrome with Burp Suite requires configuring the browser's proxy settings, and that these steps are only needed for manual testing with an external browser. It notes that Burp's own preconfigured browser can...
PortSwigger published a short guide on configuring Chrome to route through Burp Suite on macOS, covering the Web Proxy (HTTP) settings and noting the Bypass proxy settings for these Hosts & Domains field must be empty. The guide states these steps are only...
PortSwigger's documentation describes how to point an external browser at Burp instead of using Burp's preconfigured Chromium browser. The steps are to confirm the proxy listener is active, configure the browser's proxy settings for Chrome on Windows or...
PortSwigger's tutorial shows how to use the Burp Logger tab to view requests generated or modified by Burp extensions, which do not appear in the HTTP history tab because that tab only records traffic from a browser proxied through Burp. Using the...
PortSwigger's Burp Suite now requires AI credits for its AI-powered extensions, with each extension's LLM interaction deducting credits from a balance purchased through My Account and tied to a Professional license. AI features are disabled by default for...
PortSwigger's troubleshooting guide for Burp extensions explains that the BApp Store requires access to portswigger.net, and that intercepting proxies such as ZScaler which re-sign HTTPS certificates can cause Burp to distrust the connection until the...
PortSwigger's documentation describes how to install Burp Suite extensions manually from a file, covering custom extensions in .jar, .py, or .rb format and .bapp files downloaded from the BApp Store for offline or closed-network use. It notes that Python...
PortSwigger published a tutorial showing how to add a custom panel to Burp Suite's Settings dialog using the settingsPanel() builder, which supports text and number fields, checkboxes, and drop-down menus. The panel can persist settings to the project...
PortSwigger's starter project for Burp extensions using the Montoya API lets developers download a ready-to-use template from Extensions > APIs, open the ExtensionTemplateProject folder in an IDE, and begin coding without manual environment setup. The...
PortSwigger published developer instructions for compiling a Burp Suite extension into a JAR file using Gradle or Maven and loading it through Extensions > Installed with Java selected as the extension type. The guide notes that third-party libraries must...
PortSwigger published a tutorial for writing a first Burp Suite extension in Java using the Montoya API, covering setting the extension's name, registering a custom context menu item, logging messages to the Output tab, and creating a custom Burp Suite...
PortSwigger published a guide on using a remote debugger to inspect Burp extensions as they run inside Burp Suite, covering breakpoints, call stacks and variables, and code modification. The guide describes setting conditional and logging breakpoints,...
PortSwigger published developer documentation for adding AI features to Burp Suite extensions through the Montoya API, covering AI availability checks, structured prompts built from system, user, and assistant messages, exception handling via the...
PortSwigger published best practices for developers building AI-powered Burp Suite extensions through the Montoya API, requiring extensions to declare AI support via the enhancedCapabilities() method and check availability with ai.isEnabled(). The guidance...
PortSwigger's Montoya API now lets Burp Suite extensions send prompts to a Large Language Model, enabling real-time analysis of HTTP messages and intelligent responses without additional setup or external configuration. All AI interactions are managed...
PortSwigger published maintenance instructions for extensions accepted into the BApp Store, requiring developers to monitor their GitHub repository for community issues and to submit pull requests only against PortSwigger's fork of their original...
PortSwigger published acceptance criteria for extensions submitted to its BApp Store, stating that all BApps are reviewed for security and quality before a decision on inclusion. The criteria require extensions to avoid duplicating existing BApps, treat...
PortSwigger published a guide for writing Java-based custom scan checks that extend Burp Scanner, covering active versus passive check types and host, request, or insertion-point scope. Each check runs for a maximum of two minutes before Burp interrupts...
PortSwigger published a worked example showing how to write a passive custom scan check for Burp Scanner in Java, which reports an issue when a response lacks a Content-Security-Policy header. The check runs once per request, exits cleanly when no response...
PortSwigger published a worked example showing how to write an active custom scan check for Burp Scanner in Java, which sends modified requests to probe for issues Burp doesn't detect natively, such as SQL injection, server-side template injection, and...
PortSwigger published a reference guide for writing custom actions, which are scripts that run directly in Burp Repeater to automate tasks and extract information during manual testing. The guide covers seven Montoya API objects, including...
PortSwigger published a worked example of a Burp Repeater custom action, a Java script that runs directly in Repeater to automate tasks during manual testing. The script reads the HTTP response body as a string, checks for the string csrf=, extracts the...
PortSwigger published guidance on adding AI-powered features to Burp Suite custom actions through the Montoya API, using the Prompt interface to send system and user messages to the AI via ai().prompt().execute, which returns a PromptResponse read with...
PortSwigger published best practices for building AI-powered custom actions with its Montoya API, advising developers to treat raw AI output as untrusted and HTML-encode it before showing it to users. The guidance also recommends sending only essential...
PortSwigger documents that Burp Suite users can write their own custom action scripts in Java to extract, transform, and analyze data in Burp Repeater. The scripts are designed as small, self-contained pieces of logic that can include AI-powered features,...
PortSwigger's guide explains that Burp highlights compilation errors in real time as scripts are written, and these must be resolved before a script can be applied. Runtime errors appear as warnings in the relevant Burp tool after a script is applied, and...
PortSwigger published a submission process for contributing Java-based Bambda scripts to its Bambdas repository on GitHub, covering documentation with a Javadoc block and @author tag, formatting standards, and exporting scripts from Burp in YAML format....
PortSwigger's documentation describes options for customizing Burp Suite's user interface, including changing the order of content, hiding content, and detaching top-level tabs so a tab or group of tabs opens in a new window. It also covers customizing...
PortSwigger's Burp AT can investigate different parts of a target simultaneously, splitting work either through delegated AI agent workers that report results back into the task's conversation or through sub-tasks that run in separate conversations. In...
PortSwigger's documentation describes the Tasks panel in Burp Suite, where users can run multiple independent tasks at once, queue prompts, and see markers for errors, pending approvals, or unread results. It also states that the AI processing region for...