Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Professional/Community 2022.8.1 on 10 August 2022, adding scan checks for client-side desync and CL.0 request smuggling based on James Kettle's Browser-Powered Desync Attacks research presented at Black Hat USA 2022. The...
PortSwigger researcher James Kettle presented research at Black Hat USA 2022 and DEF CON 30 showing how a victim's own web browser can be turned into a desync delivery platform, poisoning browser connection pools, installing backdoors, and releasing desync...
PortSwigger released Burp Suite Professional and Community 2022.8.2 on Friday, 19 August 2022 at 12:37 UTC. The release upgrades Burp's browser to Chromium 104.0.5112.101, which the release notes say patches a critical security issue. What's compelling:...
PortSwigger released Burp Suite Enterprise Edition 2022.8 on 24 August 2022, adding a connection check tool that lets users test connectivity to target URLs before starting a scan rather than waiting for a scan to finish. The release also collates tabs...
PortSwigger researcher Gareth Heyes found a cross-domain information leak in Chrome by setting an iframe's location to about:blank and reading the baseURI property of the cross-domain window, exposing full URLs including hash and query string parameters....
PortSwigger released Burp Suite Professional and Community 2022.8.3 on Friday, 2 September 2022 at 09:12 UTC. The release upgrades Burp's embedded browser to Chromium 105.0.5195.52, which the release notes say patches a critical security issue. What's...
PortSwigger released Burp Suite Professional and Community 2022.8.4 as a stable build on Monday, 5 September 2022 at 09:19 UTC. The release upgrades Burp's embedded browser to Chromium 105.0.5195.102, which the release notes say patches a security...
PortSwigger released version 2022.9 of Burp Suite on 5 September 2022, introducing the Montoya API for developing Burp extensions alongside the existing Wiener API, which will eventually lose support. The release also adds automatic renewal of expiring...
PortSwigger researcher James Kettle describes how he added obfuscation techniques from an older paper plus some of his own to the CL.0 desync scan check in HTTP Request Smuggler, then ran it against his 20GB Burp Suite project file of bug bounty sites. A...
PortSwigger's BApp Store lists a Burp extension, version 2.0 by Teruhiro Tagomori of NRI SecureTechnologies, that generates a Postman collection JSON file from selected requests. Users select requests, choose "Export as Postman Collection" from the context...
PortSwigger's BApp Store lists a third-party Burp Suite extension called OAuth2 Token Grabber, authored by 0kman at version 1.1, that grabs OAuth2 access tokens and adds them to requests as a custom header. The listing was last updated on 08 September...
PortSwigger researcher Gareth Heyes documented a seventh technique for calling JavaScript functions without parentheses, using tagged template strings where placeholders are passed as arguments with their original type rather than as strings. He shows that...
PortSwigger released Burp Suite Professional and Community 2022.9.1 on 16 September 2022, upgrading Burp's browser to Chromium 105.0.5195.125 to patch a number of high-severity security issues. The release also fixed minor bugs, including that disabling...
PortSwigger researcher James Kettle described a technique that upgrades HTTP header injection into a request desync, letting an attacker poison the response queue so they intermittently receive responses meant for other authenticated users. Applied to a...
The 403 Bypasser is a Burp Suite extension, version 1.2, listed in the BApp Store and last updated on 27 September 2022, with an estimated overall system impact rated Low. PortSwigger states that extensions are written by third-party users of Burp and that...
PortSwigger's "Diff last response" Burp extension, authored by Gareth Heyes and listed at version 1.0.10, shows the difference between the previous and current response using color coding. Blue marks changes in the response, green marks sections added, and...
PortSwigger released Burp Suite Professional and Community 2022.8.5 as a stable build on Thursday, 29 September 2022 at 13:32 UTC. The release upgrades Burp's embedded browser to Chromium 106.0.5249.61, which the release notes say fixes a number of...
PortSwigger Research highlighted seven community submissions to its XSS cheat sheet, published October 3, 2022 and updated October 20, 2022, ranking them from missing events submitted by @hahwul to a top entry from @ladecruze that uses the location object,...
PortSwigger released Burp Suite Professional/Community 2022.9.2 on 4 October 2022, adding several new features to the Montoya API along with bug fixes for Burp Scanner. The release also updates Burp's browser to Chromium 106.0.5249.61, which the release...
PortSwigger released Burp Suite Professional/Community 2022.9.3 on 14 October 2022, upgrading Burp's browser to Chromium 106.0.5249.119, which fixes a number of high-severity security issues. The release also patches a low-severity security issue reported...
PortSwigger researcher James Kettle documented how first-request routing in reverse proxies, combined with browser HTTP connection coalescing, lets a request to one hostname be routed to another back-end on the same connection, so XSS on...
Paramalyzer is a Burp Suite extension, version 2.2.2 by Jason Gillam and last updated 25 October 2022, that performs in-depth parameter analysis on all in-scope Burp traffic during web penetration tests. It displays results in an interactive table that can...
PortSwigger launched a scholarship scheme directed at young women starting tech careers, offering paid work, tailored personal development, financial support, and the potential for a permanent position after graduation. The company spoke with Charlotte and...
PortSwigger released Dastardly, a free, lightweight dynamic (DAST) web application security scanner built for CI/CD pipelines and using a stripped-down version of the Burp Suite scanner. The company says scans complete in ten minutes or less and cover...
PortSwigger released Burp Suite Professional/Community 2022.9.5 on 27 October 2022, introducing the Montoya API as a replacement for the Wiener API, with the old API continuing to work for the immediate future. The release also added automatic renewal of...
PortSwigger researcher Gareth Heyes found that Safari's OCR feature parses URLs found in images, so hovering over an image can surface a clickable link - in his case, the Amazon logo on his company homepage produced a link to "Zon.com" because an arrow...
PortSwigger released Burp Suite Professional/Community 2022.11 on 7 November 2022, moving all User and Project options into a new Settings dialog with per-setting markers for user or project level and an override toggle. The release also added DOM Invader...
PortSwigger researcher Gareth Heyes published a post on 9 November 2022 describing an update to Burp Suite's DOM Invader tool that inspects web message data and flags messages containing URL data sent to a different origin. The feature, built after reading...
PortSwigger released Burp Suite Professional and Community 2022.9.6 as a stable build on Thursday, 10 November 2022 at 13:37 UTC. The release upgrades Burp's browser to Chromium 107.0.5304.110, which the release notes say fixes a number of high-severity...
PortSwigger released Burp Suite Professional and Community 2022.11.1 as an Early Adopter build on Friday, 11 November 2022. The release upgrades Burp's embedded browser to Chromium 107.0.5304.110, which the release notes say fixes a number of high-severity...