Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's BApp Store lists AES Payloads, a third-party extension by Luis Grangeia, version 1.0a, last updated 04 February 2022, that adds encryption and decryption of AES payloads to Burp Intruder and Scanner. PortSwigger states the extension is...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Burp Share Requests, version 1.0a by Static-Flow, last updated 04 February 2022, that generates shareable links to specific requests other Burp users can import. After installation a...
PortSwigger's BApp Store lists a third-party Burp Suite extension called CSRF Scanner, authored by Adrian Hayter at version 1.4a, that passively checks for cross-site request forgery vulnerabilities as part of normal passive scanning. The listing was last...
Handy Collaborator is a Burp Suite extension by Federico Dotta and Gianluca Baldi, version 0.2a, that generates Collaborator payloads from the contextual menu of editable tabs such as Repeater and Intercept. A separate thread periodically checks all DNS,...
PortSwigger's BApp Store lists a Burp Suite extension, authored by Federico Dotta and updated 04 February 2022, that adds active and passive scanner checks for Java deserialization vulnerabilities plus a manual tab. It supports payloads in Raw, Base64,...
PortSwigger's BApp Store lists JOSEPH, a Burp Suite extension by Dennis Detering at version 1.0.2a, last updated 04 February 2022, that helps test applications using JavaScript Object Signing and Encryption, including JSON Web Tokens. PortSwigger notes the...
The JVM Property Editor is a Burp Suite extension, authored by Jeffrey Cap (Bort_Millipede) at version 0.3a and last updated 04 February 2022, that lets the user view and modify JVM system properties while Burp is running. PortSwigger states the extension...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Non HTTP Proxy (NoPE), short for Non-HTTP Protocol Extension Proxy, which adds two new features to Burp for traffic Burp otherwise won't handle. The extension is by Josh Summitt, at...
Burp Bounty is a third-party Burp Suite extension, version 4.0a, that lets users improve the active and passive scanner through personalized rules entered in a graphical interface. It builds custom issue profiles by searching for patterns and refining the...
PortSwigger Research published its community-powered Top 10 new web hacking techniques of 2021, drawing on 40 nominated research papers that the infosec community voted down to 15 finalists, with an expert panel of Nicolas Grégoire, Soroush Dalili,...
PortSwigger released Burp Suite Professional and Community 2022.1.1 on Wednesday, 9 February 2022, adding new options for customizing the appearance and behavior of the Inspector panel. The release lets users hide widgets, reorder them, set automatic...
PortSwigger's BApp Store lists a Burp extension called WS Security, authored by Robin Fassina-Moschini at version 1.0a and last updated 10 February 2022, that generates WS-Security UsernameToken values on the fly and inserts them into SOAP requests. The...
PortSwigger's BApp Store lists Token Extractor, a Burp Suite extension by Will Strei, version 1.3.2a, last updated 10 February 2022, that extracts tokens from a response and replaces them in requests. The listing says it is useful for anti-CSRF tokens,...
The XSS Validator is a Burp Suite extension that sends base64-encoded page responses to a locally running XSS-Detector server built on Phantom.js and/or Slimer.js, which listens by default on port 8093. Users copy the extension's Grep Phrase into Burp...
Autowasp is a Burp Suite extension, authored by GovTech's Thomas Lim and listed at version 1.0.1a, that integrates Burp issues logging with the OWASP Web Security Testing Guide to streamline web security testing. The BApp Store listing says it guides new...
PortSwigger's BApp Store lists a Burp Suite extension called Custom Send To, authored by Thomas Engel, that adds a configurable "Send to..." context menu to Burp, with entries added, edited, removed, and reordered from a dedicated tab. The extension's own...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Auto-Drop Requests, version 1.0.0a, authored by sunny0day and last updated on 10 February 2022. The extension automatically drops requests that match a specified regex, which the...
PortSwigger's BApp Store lists a third-party Burp extension called Flow, authored by Marcin Woloszyn at version 1.25a and last updated 10 February 2022, which adds a Proxy history-style view with search filters across all Burp tools. The extension shows...
PortSwigger's BApp Store lists a third-party Burp extension, version 0.0.2a by Josh Summitt, last updated 10 February 2022, that generates various Java serialized payloads designed to execute OS commands. The listing states the extension can be used in...
The Commentator is a Burp Suite extension, version 1.2a by Andras Veres-Szentkiralyi, that generates comments for selected requests based on regular expressions. It was last updated on 10 February 2022 and carries an overall system impact rating of...
CSP Auditor is a Burp Suite extension by Philippe Arteau of GoSecure, version 2.0a, last updated 11 February 2022, that gives a readable view of CSP headers for responses. It also includes passive scan rules to detect weak CSP configurations, and...
PortSwigger released Burp Suite Professional / Community 2022.2 on 16 February 2022, optimizing Burp Scanner's Fastest crawl strategy for static sites by disabling features such as automated session handling and state recovery. The release also upgraded...
CustomDeserializer is a Burp Suite extension by Marco Tinari, version 1.1a and last updated 21 February 2022, that performs custom deserialization to speed up manual testing of web applications. It adds an editor tab for decoding and encoding parameters on...
Custom Parameter Handler is a Burp Suite extension, version 3.0a, that lets a user modify any part of an HTTP message rather than only the name=value parameters that macros typically support. It requires Jython 2.7.0, was last updated on 21 February 2022,...
LightBulb is an open source Python framework for auditing web application firewalls and filters, built on automata learning algorithms that model a WAF remotely by querying it and observing output. Its authors, George Argyros and Ioannis Stais, presented...
PortSwigger's BApp Store lists a third-party Burp extension called Proxy Action Rules, written by James Morris of Central InfoSec, version 1.0a, last updated 21 February 2022. The extension can automatically forward, intercept, and drop proxy requests...
PortSwigger Research describes a Burp Suite extension, Upload Scanner, built to automate attacks against HTTP file uploads, including XSS, XXE, PHP/JSP/ASP code injection, and SSRF through m3u8 playlists parsed with LibAv. The extension is divided into...
PortSwigger released Burp Suite Enterprise Edition 2022.1.1 on 21 February 2022 with no new functionality, only background changes preparing for a future release. That future release adds a Kubernetes deployment option using a Helm chart, replacing the...
BurpelFish is a Burp Suite extension by Paul Taylor, version 0.04a, that adds Google Translate to Burp's context menu for translating web content during app-security testing in other languages. It requires an API key, available via a provided link, though...
YesWeBurp is a Burp Suite extension, version 1.0.2a, that lets users access their YesWeHack bug bounty programs directly inside Burp and configure Burp according to each program's rules. It was last updated on 25 February 2022, carries a Low estimated...