Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Enterprise Edition 2022.10 on 11 November 2022, adding recorded login replays to site health checks so users can review screenshots and confirm that saved login scripts authenticate successfully. The release also automates...
PortSwigger researcher Gareth Heyes found an HTML injection flaw in the Glitch fork of Mastodon used by infosec.exchange that let him spoof a login form and capture credentials via Chrome autofill without bypassing CSP. Mastodon released versions 4.0.1,...
PortSwigger released Burp Suite Professional/Community 2022.11.2 on 25 November 2022, moving all User and Project options into a new Settings dialog accessible from the main toolbar or a configurable hotkey. The release also added DOM Invader detection of...
PortSwigger released Burp Suite Professional/Community 2022.12 on 25 November 2022, adding support for replaying recorded login sequences that open new windows or tabs, such as Microsoft and Amazon SSO logins, and a new Live crawl view tab in the Scan...
PortSwigger's BApp Store lists a third-party Burp extension called Add to sitemap+, version 1.0, authored by quahac and last updated 28 November 2022, which reads URLs from files or clipboard and adds the discovered information to the site map of the...
PortSwigger researcher Gareth Heyes described a variant of service worker hijacking triggered through DOM clobbering, exploiting a quirk in document.getElementById() where injecting an <html> or <body> tag with a matching id can override the element the...
PortSwigger launched the Burp challenge, a four-stage program in which participants complete practitioner-level labs, eight specific labs, five mystery labs, and a practice exam by 31 December 2022 to earn a free exam credit for the Burp Suite Certified...
Burp Suite Enterprise Edition 2022.11, released 30 November 2022, adds the ability to export issue data from scans in XML format via the Export Issue Data option on the Reporting tab. The release also fixes some minor bugs. What's compelling: Teams that...
PortSwigger released Burp Suite Professional and Community 2022.12.1 as an early adopter build on Thursday, 1 December 2022 at 14:30 UTC. The release upgrades Burp's embedded browser to Chromium 108.0.5359.71, which the release notes say fixes a number of...
PortSwigger released Burp Suite Professional and Community 2022.11.3 as a stable build on Thursday, 1 December 2022 at 15:04 UTC. The release upgrades Burp's embedded browser to Chromium 108.0.5359.71, which the release notes say fixes a number of...
PortSwigger released Burp Suite Professional and Community 2022.12.2 as an Early Adopter build on Tuesday, 6 December 2022 at 10:03 UTC. The release upgrades Burp's embedded browser to Chromium 108.0.5359.94/95. What's compelling: Burp's bundled browser...
PortSwigger is rewriting the Wiener API used for Burp Suite Professional and Community Edition extensions under the codename Montoya, and the feature-parity Montoya API has been available since Burp Suite 2022.9.5. Version 2022.11 added API support for...
PortSwigger lists WebAuthn CBOR, a Burp Suite extension by Srikanth Ramu at version 1.0, as a tool to decode the CBOR format used in WebAuthn, the W3C standard for strong user authentication that relies on Base64url encoding, CBOR, and COSE. The listing...
PortSwigger released Burp Suite Professional and Community 2022.12.3 on 12 December 2022, fixing bugs relating to saving reports and Burp's browser. The release also upgrades Burp's browser to Chromium 108.0.5359.98 / 99, and fixes a Windows report-saving...
PortSwigger released Burp Suite Professional/Community 2022.12.4 on 15 December 2022, adding support for popup windows when recording logins and a new Live crawl view tab in Burp Scanner. The release also adds DOM clobbering detection to DOM Invader,...
PortSwigger rewrote the entire embedded browser integration layer of Burp Scanner, two years after launching browser powered scanning, to support browser actions that open new tabs or windows in recorded logins. The original code connected to a single...
Sentinel is a Burp Suite extension, authored by Dobin Rutishauser at version 0.9.1 and last updated 20 December 2022, that helps test for vulnerability categories including XSS and SQL injection. A user selects an HTTP request and chooses "Send to...
Taborator is a Burp Suite extension, authored by PortSwigger's Gareth Heyes at version 2.1.6 and last updated 20 December 2022, that displays the Collaborator client in a tab and notifies users of new interactions in the tab title. It lets users...
PortSwigger's BApp Store lists Request Minimizer, a Burp Suite extension by George Noseevich (version 1.3.2, last updated 20 December 2022) that strips HTTP request parameters judged irrelevant, such as random ad cookies and cachebusting nonces. It adds...
PortSwigger released Burp Suite Professional and Community 2022.12.5 on Wednesday, 21 December 2022 at 11:16 UTC. The release contains a bug fix for Burp's diagnostics, which previously did not return details of installed extensions in its diagnostic...
PortSwigger's BApp Store lists a third-party Burp extension called Potential Vulnerability Indicator, authored by CodeWatchOrg at version 0.3.10 and last updated 05 January 2023. The listing states the extension runs checks only on items in scope and...
PortSwigger released Professional / Community 2022.12.6 on 12 January 2023, upgrading Burp's browser to Chromium 109.0.5414.74/.75/.87 and fixing a minor bug. The release also enables the Auto backoff and Enable concurrent request limiting settings in Burp...
PortSwigger released Burp Suite Professional / Community 2023.1 on 12 January 2023, moving more settings into the Settings dialog, including all settings for certain Burp tools under the Tools section. The release upgraded the Montoya API to version 1.0.0...
The Import to Sitemap extension for Burp Suite, authored by NCC Group and last updated 17 January 2023, adds a tab that loads a CSV file into Burp's sitemap. It includes an "Enable Fakeparam Trick" checkbox, on by default, that appends an artificial...
PortSwigger's BApp Store lists a third-party Burp extension by author codewatchorg, version 0.1.14, that performs a passive scan to identify cloud buckets and then tests them for publicly accessible vulnerabilities. The extension looks at all responses,...
PortSwigger released Burp Suite Enterprise Edition 2023.1 on 23 January 2023, adding support for popup windows when recording logins so Burp Scanner can replay login sequences that open new windows or tabs, including Microsoft and Amazon SSO services. The...
PortSwigger released Burp Suite Professional / Community 2023.1.1 on 25 January 2023, adding minor improvements to authenticated crawling with popup-based login mechanisms and a number of bug fixes. The release also upgrades Burp's browser to Chromium...
PortSwigger released Burp Suite Professional and Community 2022.12.7 as a stable build on Thursday, 26 January 2023 at 11:34 UTC. The release upgrades Burp's browser to Chromium 109.0.5414.119/.120. What's compelling: The bundled browser is the component...
PortSwigger launched the Burp Suite Certified Practitioner (BSCP) certification at the end of 2021 in response to demand from Burp Suite Professional customers, and Packetlabs, a Canada-based firm that uses Burp Suite Professional exclusively for web...
PortSwigger's January 2023 Burp Suite roadmap lists completed work including popup support in recorded login sequences and revamped browser-powered scanning in the 2022.12.4 release, plus XML export of scan results in 2022.11 and replay of recorded login...