Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
The Python Scripter BApp for Burp Suite, authored by Marcin Wielgoszewski and Mike Cromwell at version 2.1, executes custom Python scripts against each HTTP request and response and supports handling Macro messages. Items placed in the 'state' dictionary...
The ExifTool Scanner is a Burp Suite extension, version 1.0.9 by Michal Dardas, that reads metadata from filetypes including JPEG, PNG, PDF, DOC and XLS using ExifTool. It presents results as Passive scan issues and Message editor tabs, and embeds Windows,...
PortSwigger released Burp Suite Professional/Community 2022.5 on 26 May 2022, adding eight new JWT-based scan checks to Burp Scanner and an option to skip unauthenticated crawling when application logins are provided. The release also shows estimated...
PortSwigger released Burp Suite Professional and Community 2022.3.9 as a stable build on Friday, 27 May 2022 at 07:52 UTC. The release upgrades Burp's browser to Chromium 102.0.5005.61, which the release notes say fixes a number of security issues. What's...
PortSwigger released Burp Suite Enterprise Edition 2022.5 on 6 June 2022, adding the ability to raise tickets for multiple issues at once in Jira, GitLab and Trello, either as separate tickets per issue or combined by issue type. The release also moves...
PortSwigger's BApp Store lists "CORS* - Additional CORS Checks," a Burp Suite extension by Yves Bieri (version 0.9.1, last updated 08 June 2022) that tests websites for CORS misconfigurations, including arbitrary origin reflection and subtler cases where a...
TokenJar is a Burp Suite extension, authored by Dan Negrea and listed at version 2.2, that manages tokens such as anti-CSRF values, CSurf tokens, and session IDs. It sets parameters requiring random numbers or values computed from application responses,...
PortSwigger published a Q&A recap from its PortSwigginar webinar on Burp Suite Enterprise Edition, covering deployment options, licensing, a Jenkins pipeline scan launch, and a roadmap preview. The answers state that the tool can be installed on any 64-bit...
PortSwigger researcher Gareth Heyes found that setting a cross-domain iframe's location to about:blank in Chrome transfers ownership of the frame to the setting domain, making window.name readable and writable and allowing JavaScript execution regardless...
PortSwigger released Burp Suite Professional/Community 2022.5.1 on 16 June 2022, adding eight new JWT-based scan checks, an option to skip unauthenticated crawling when application logins are provided, and estimated system-load indicators for BApps in the...
PortSwigger added an Estimated system impact feature to Burp Suite as of version 2022.5.1, showing itemized impact estimates for every BApp in the BApp Store plus an aggregated estimate based on the BApps a user has installed. Ratings for individual BApps...
PortSwigger released Burp Suite Professional / Community 2022.6 on 20 June 2022, adding color-coded Repeater tab groups, a tab bar search function, and a choice between wrapped and scrollable tab views for Intruder and Repeater. The release also introduced...
PortSwigger upgraded its DOM Invader tool in Burp Suite 2022.6 to detect client-side prototype pollution (CSPP) in a few clicks, testing the query string, hash, and JSON objects sent via web messages and reporting successful sources. The tool can then scan...
PortSwigger researcher Gareth Heyes documented client-side prototype pollution gadgets in browser APIs and common libraries, including fetch, Object.defineProperty, and localStorage/sessionStorage, where polluted Object.prototype properties can control...
PortSwigger released Burp Suite Professional and Community 2022.5.2 on Thursday, 23 June 2022 at 08:52 UTC. The release upgrades Burp's browser to Chromium 103.0.5060.53, which the release notes say patches a critical security issue. What's compelling:...
PortSwigger released Burp Suite Professional/Community 2022.6.1 on 23 June 2022, adding HTTP/1 keep-alive so Burp can reuse a single TCP connection for multiple requests, preset scan modes in the Scan Configuration menu, and tab grouping and search for...
PortSwigger's BApp Store lists an extension called HTTP Mock, version 1.1.7, that serves customizable mock responses based on real ones, with requests matched by customizable regex rules and forwarded to a local mock server. Written by Michal Dardas and...
PortSwigger researcher Gareth Heyes found that Firefox's experimental HTML Sanitizer API blocked SVG imports via data URLs and relative URLs but allowed same-origin absolute URLs, so an uploaded SVG protected only by Content-Disposition: attachment could...
PortSwigger released Burp Suite Enterprise Edition 2022.6 on 1 July 2022, adding four preset scan modes - Lightweight, Fast, Balanced, and Deep - that adjust the balance of speed and coverage with a single click. The release also improves scan duration...
PortSwigger added tab grouping, color-coding, and a name-based search function to Burp Repeater and Intruder, plus an option to display both tools' tabs in a single scrollable row. The company says the same tab-based features will soon come to Intruder,...
PortSwigger released Burp Suite Professional/Community 2022.7 on 6 July 2022, adding tab-specific options in Repeater and client-side prototype pollution detection in Burp Scanner. The release also changed Burp's browser to respect the configured...
Burp2Telegram is a Burp Suite extension, version 1.0 and last updated 08 July 2022, that matches traffic from Intruder, Repeater, Proxy and Scanner against user-defined input conditions. When a condition is met, it pushes a customizable notification to a...
PortSwigger held a PortSwigginar session on July 13 covering Burp Suite Enterprise Edition, and published the video along with answers to attendee questions. The answers state that offline activation is not supported - license activation requires a...
PortSwigger's July 2022 roadmap update reports Burp Suite Enterprise Edition approaching 1,000 subscribers, with Kubernetes deployment via Helm chart shipped in version 2022.3 and PCI DSS and OWASP Top 10 compliance reporting added in 2022.4. The update...
PortSwigger released Burp Suite Professional/Community 2022.7.1 on 22 July 2022, adding tab-specific options in Repeater and client-side prototype pollution detection in Burp Scanner. The release also changes Burp's browser to respect the configured...
PortSwigger released Burp Suite Professional/Community 2022.8 on 25 July 2022, adding the ability to send all requests in a group of Repeater tabs sequentially with one click, over a single connection or a separate connection per request. The release also...
PortSwigger released Burp Suite Enterprise Edition 2022.7 on 26 July 2022, adding a Timeline tab with a progress bar, live updates as issues are discovered, and an estimate of time remaining. The release also reports scan errors as they are found with...
PortSwigger marked one year since launching its Burp Suite Certified Practitioner exam, a practical, time-based test of exploiting common web vulnerabilities with Burp Suite Professional. Based on user feedback and internal testing, the company extended...
PortSwigger researcher Gareth Heyes found new ways to frame a web site without the iframe element: Chrome allows param tags to change the URL of an object tag, and Chrome and WebKit allow the "code" attribute in an embed tag to reference an external URL....
PortSwigger's BApp Store lists Backup Finder, a Burp Suite extension by Moein Fatehi (version 0.2, last updated 04 August 2022) that reviews backup, old, temporary, and unreferenced files on a webserver for sensitive information. The author states that...