Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research published its 16th annual Top 10 Web Hacking Techniques list for 2022, drawing a record 46 community nominations that were narrowed to 15 finalists and judged by a panel of Nicolas Grégoire, Soroush Dalili, Filedescriptor and James...
PortSwigger released Burp Suite Professional/Community 2023.1.2 on 9 February 2023, moving more tool settings into the Settings dialog, upgrading the Montoya API to version 2023.1 so extensions can store and manage data in project files, and adding macro...
PortSwigger released Burp Suite Professional/Community 2023.2 on 9 February 2023, adding improved Montoya API support for WebSockets so extensions can interact more effectively with them. The release also includes minor improvements and bug fixes, upgrades...
PortSwigger released Burp Suite Professional/Community 2023.2.1 on 15 February 2023, upgrading Burp's browser to Chromium 110.0.5481.96/.97 and fixing a bug where the Hackvertor tab did not display correctly in the message editor when using the Hackvertor...
PortSwigger researcher Gareth Heyes published techniques for detecting server-side prototype pollution black-box without causing a denial of service, since polluting a global prototype persists for the lifetime of the Node process and can break the app for...
PortSwigger released Burp Suite Professional/Community 2023.1.3 on 1 March 2023, upgrading Burp's browser to Chromium 110.0.5481.177/178. The release states the upgrade contains a critical security fix plus several high-severity fixes, and that Burp...
PortSwigger released Burp Suite Professional/Community 2023.2.2 on 1 March 2023, upgrading Burp's browser to Chromium 110.0.5481.177/178, an upgrade it says contains a critical security fix plus several high-severity fixes. The release also fixes a bug...
RouteVulScan is a Java-based Burp plug-in, version 1.4 and last updated 08 March 2023, that recursively detects vulnerable paths through passive scanning and matches package keywords using configurable regular expressions. Detected URLs are printed in...
PortSwigger released Burp Suite Enterprise Edition 2023.2 on 8 March 2023, adding the ability to configure scan settings for all sites in a folder at once, with settings applied to subfolders and sites and combined across folder, subfolder, and site...
PortSwigger released Burp Suite Professional / Community 2023.3 on 10 March 2023, adding support for Collaborator payloads in Intruder attacks so that resulting interactions appear in the Intruder results window rather than the Collaborator tab. The...
PortSwigger released Burp Suite Professional/Community 2023.2.3 on 10 March 2023, adding improved WebSocket support to the Montoya API so extensions can interact with WebSockets more effectively, alongside minor improvements and bug fixes. The release...
PortSwigger released a Burp Suite extension, version 1.0.8, that identifies server-side prototype pollution vulnerabilities and requires Burp Suite v2021.9 or later. Users right-click a request, open the extensions menu, select server side prototype...
PortSwigger released BSEEPT, a set of power tools that exposes every aspect of the Burp Suite Enterprise Edition GraphQL API from the command line or from Python code. The project, built over more than 80 commits, lets teams pull scan details, extract...
PortSwigger released Burp Suite Professional and Community 2023.3.1 as an early adopter build on Thursday, 23 March 2023. The release upgrades Burp's embedded browser to Chromium 111.0.5563.110/.111 on Windows and 111.0.5563.110 on Mac and Linux, and the...
PortSwigger released Burp Suite Professional and Community 2023.2.4 as a stable release on Thursday, 23 March 2023 at 14:54 UTC. The release upgrades Burp's browser to Chromium 111.0.5563.110/.111 for Windows and 111.0.5563.110 for Mac and Linux, and the...
PortSwigger researcher Gareth Heyes documented a new server-side prototype pollution exploitation technique that uses Node's --import command line flag, available from Node 19.0.0, to load a data: URL module and execute arbitrary JavaScript without placing...
PortSwigger Research disclosed that a documented curl feature, where a request body or header starting with an @ symbol is read as a local file, led to a local-file disclosure vulnerability in both Burp Suite Pro and Google Chrome. The issue was privately...
PortSwigger released Burp Suite Professional/Community 2023.3.2 on 6 April 2023, adding support for Collaborator payloads in Intruder attacks and showing resulting Collaborator interactions in the Intruder results window rather than the Collaborator tab....
PortSwigger released Burp Suite Professional and Community 2023.3.3 as a stable build on Thursday, 13 April 2023 at 14:11 UTC. The release fixes a bug that prevented Linux ARM64 users from launching Burp using the JAR file. What's compelling: Teams...
PortSwigger released Burp Suite Professional and Community 2023.3.4 as a stable release on Monday, 17 April 2023 at 14:57 UTC. The release upgrades Burp's built-in browser to Chromium 112.0.5615.121. What's compelling: The built-in browser is the...
PortSwigger released Burp Suite Professional and Community 2023.4.1 on 17 April 2023, upgrading Burp's built-in browser to Chromium 112.0.5615.121. The release also fixes a bug that was preventing Burp Intruder tasks from loading properly in some...
PortSwigger released Burp Suite Professional and Community 2023.3.5 as a stable build on Friday, 21 April 2023 at 09:15 UTC. The release upgrades Burp's built-in browser to Chromium 112.0.5615.137/138 for Windows, 112.0.5615.165 for Linux, and...
PortSwigger released Burp Suite Professional and Community 2023.4.2 as an Early Adopter build on 21 April 2023. The release upgrades Burp's built-in browser to Chromium 112.0.5615.137/138 on Windows, 112.0.5615.165 on Linux, and 112.0.5615.137 on Mac, and...
PortSwigger released Burp Suite Enterprise Edition 2023.4 on 24 April 2023, adding controls over site scope so Burp Scanner visits only the URLs users want scanned. The release also lets users see how site scope is derived from start URLs, adds in-scope...
PortSwigger researcher Gareth Heyes found a CSP bypass in the Piwik PRO analytics platform after spotting an AngularJS 'ng-app' directive inside its debugger, which loaded scripts allow-listed by the site's CSP. Piwik PRO fixed it by tightening the CSP to...
PortSwigger released Burp Suite Enterprise Edition 2023.4.1 on Tuesday, 2 May 2023 at 10:06 UTC, a stable release that fixes a bug. The release removes an unused Log4J library that could trigger security alerts. What's compelling: A dormant Log4J library...
PortSwigger released Burp Suite Professional/Community 2023.5 on 12 May 2023, adding the Burp Organizer tool for storing copies of HTTP messages, a live Crawl paths tab in the Task details dialog, and Montoya API upgrades for extension development. The...
PortSwigger released Burp Suite Professional/Community 2023.4.3 on 15 May 2023, adding improvements to Burp Intruder and Burp Scanner, ARM64 support for Linux, and a number of minor improvements and bug fixes. The release also updated the Montoya API,...
PortSwigger released Burp Suite Professional and Community 2023.4.4 on Friday, 19 May 2023, upgrading Burp's embedded browser to Chromium 113.0.5672.126 on Mac and Linux and 113.0.5672.126/.127 on Windows. The release notes state this contains a critical...
PortSwigger released Burp Suite Professional/Community 2023.5.1 on 19 May 2023, with minor changes to the Burp Suite Navigation Recorder browser extension and an upgrade of Burp's browser to Chromium 113.0.5672.126 on Mac and Linux and 113.0.5672.126/.127...