Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's BApp Store lists an SSL Scanner extension for Burp Suite, version 1.2a by Pattara Teerapong and Meatasit Karakate, last updated 25 February 2022. Most of its testing logic comes from testssl.sh, with Heartbleed and CCS Injection test code...
PortSwigger's BApp Store lists Response Grepper, a Burp Suite extension by author b4dpxl that auto-extracts and displays values from HTTP response bodies using a per-request regular expression, similar to Burp Intruder's "Grep - Extract" but applied to any...
PortSwigger's BApp Store lists a Burp extension by James Morris of Central InfoSec, version 1.0a and last updated 25 February 2022, that lets users add and track custom scan issues within Burp. Burp records issues from active and passive scans but does not...
A Burp Suite extension called Cloud Storage Tester, authored by Elliott Frantz at version 1.0a and last updated 25 February 2022, identifies and tests S3 buckets, Google Storage buckets, and Azure Storage containers for common misconfiguration issues....
Timeinator is a Burp Suite extension, authored by FSecureLABS and listed at version 1.0a with a last update of 25 February 2022, that performs timing attacks over unreliable networks such as the internet. It works like Burp Intruder's sniper mode but sends...
PortSwigger released version 2022.2 of its Enterprise Edition Jenkins plugin on Tuesday, 1 March 2022, fixing an issue in the previous version. That earlier release made the Burp Suite Enterprise Edition UI non-functional when used alongside the...
PortSwigger released Burp Suite Professional and Community 2022.2.2 as an Early Adopter build on Thursday, 3 March 2022. The release provides minor bug fixes, most notably a fix for an issue that sometimes cut recorded login sequences short when testing...
PortSwigger released Burp Suite Professional/Community 2022.2.3 on 11 March 2022, adding a Fastest crawl strategy optimized for static sites that cuts crawl time on its static documentation site from around 45 minutes to well under 10 minutes, plus...
PortSwigger added a mystery lab challenge to its Web Security Academy that generates a random lab for users to find and exploit, with the objective hidden by default. The challenge has three settings: objective fully hidden, objective displayed, and full...
PortSwigger released Burp Suite Professional and Community 2022.2.4 as a stable version on Thursday, 17 March 2022 at 13:05 UTC. The release upgrades Burp's embedded browser to Chromium 99.0.4844.74, which the release notes say fixes one critical bug and a...
PortSwigger released Burp Suite Professional / Community 2022.3 on 21 March 2022, adding message editor tabs that replicate the Inspector panel's features and a new public Burp Collaborator domain, *.oastify.com, alongside the existing...
PortSwigger released Burp Suite Professional and Community 2022.3.1 as an Early Adopter build on Tuesday, 29 March 2022 at 14:14 UTC. The release fixes two Burp Repeater bugs - an infinite redirect loop when manually following redirections, and the message...
PortSwigger announced that Burp Scanner's passive checks will be replaced with "passive-aggressive" checks, framed as a way to push users toward fixing lower-severity issues found during passive browsing. The post says the change would reach Burp Suite's...
PortSwigger released Burp Suite Professional and Community 2022.3.2 on Monday, 4 April 2022, a release it describes as providing a number of bug fixes and an upgrade for Burp's browser. The browser was upgraded to Chromium 100.0.4896.60, and the fixes...
PortSwigger released Burp Suite Enterprise Edition 2022.3 on 5 April 2022, adding deployment to any Kubernetes cluster that meets a few prerequisites via a Helm chart, which enables auto-scaling of scanning resources. The release replaces the existing AWS...
PortSwigger's release 2022.3 introduces a new Kubernetes deployment for Burp Suite Enterprise Edition, installed via a Helm chart and Helm install command that takes minutes on an existing cluster, or about 30 minutes more if a new cluster must be created....
Burp Suite Professional version 2022.2.3 made Burp Scanner's crawler between 6x and 9x faster against static or stateless sites, depending on whether Burp's browser is enabled. The gain came from removing the state-tracking process from the "Fastest" crawl...
PortSwigger released Burp Suite Professional and Community 2022.3.4 as an Early Adopter build on Monday, 11 April 2022 at 23:00 UTC. The release provides Java 17 support for some extensions that previously failed to load. What's compelling: Extensions...
PortSwigger released Burp Suite Professional and Community 2022.3.5 on Tuesday, 19 April 2022, upgrading Burp's browser to Chromium 100.0.4896.127 and adding several minor bug fixes. The release fixes an issue that prevented some extensions from loading...
Turbo Data Miner is a Burp Suite extension, version 2.0 by developer Chopicalqui, that adds a Turbo Miner tab and a context menu entry for running Python scripts against request/response items in Proxy History, the Side Map, or traffic sent and received by...
PortSwigger released Burp Suite Professional and Community 2022.2.5 as a stable build on Wednesday, 20 April 2022 at 12:37 UTC. The release upgrades Burp's embedded browser to Chromium 100.0.4896.127. What's compelling: The bundled browser is the...
PortSwigger researcher Gareth Heyes, updating the company's XSS cheat sheet in April 2022, found that transition events could fire without a style block by targeting the outline property, since Chrome adds an outline to focusable elements for...
PortSwigger published configuration guidance for Burp Suite Enterprise Edition, its dynamic web vulnerability scanner, aimed at optimizing scans across a whole portfolio. The article covers giving Burp Scanner adequate resources since DAST scanning is...
PortSwigger Research said it has removed the term "agent" from Burp Suite Enterprise Edition's user interface, website, and product documentation because the word was being used for three different things: the logical entities performing scans, the...
PortSwigger released Burp Suite Professional/Community 2022.3.6 on 29 April 2022, adding message editor tabs that replicate Inspector panel features and introducing the *.oastify.com domain for the public Burp Collaborator server in place of...
PortSwigger released Burp Suite Enterprise Edition 2022.4 on 6 May 2022, adding compliance reporting formats for PCI DSS and the OWASP Top 10. The release also adds automated GitLab ticket and Trello card creation for issues above a specified severity and...
PortSwigger released Burp Suite Professional and Community 2022.3.7 on Wednesday, 11 May 2022, upgrading Burp's browser to Chromium 101.0.4951.54. The release also fixes a bug that could corrupt project files after saving an Intruder attack, a Headers tab...
PortSwigger Director of Research James Kettle presented a keynote at Nullcon Berlin on hunting evasive vulnerabilities, drawing on a decade of web security research to examine what hid both individual bugs and entire attack classes. The talk covers...
PortSwigger researcher Carlos Montoya built Gin and Juice Shop, a deliberately vulnerable web application with single-use CSRF tokens and heavy JavaScript that is intended to give scanners a realistic target. The site contains XSS, SQLi, and external...
PortSwigger released Burp Suite Professional / Community 2022.3.8 on Friday, 20 May 2022, fixing an issue that caused Kubernetes deployments of Burp Suite Enterprise Edition to crash due to insufficient shared memory. The release also fixed a bug that...