Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Professional and Community 2023.4.5 as a stable build on Thursday, 25 May 2023 at 12:37 UTC, with installers for Windows, macOS, Linux, and a JAR. The release fixes a bug that sometimes prevented Burp Scanner from crawling...
PortSwigger released Burp Suite Professional/Community 2023.5.2 on 1 June 2023, adding the new Burp Organizer tool for storing copies of HTTP messages, a live Crawl paths tab in the Task details dialog, and Montoya API upgrades. The Crawl paths tab shows...
PortSwigger researcher Gareth Heyes published a technique on 5 June 2023 for bypassing Content Security Policy using DOM clobbering, demonstrated on a test case modeled on a bug bounty site. The method requires three conditions - HTML injection, a gadget...
PortSwigger released Burp Suite Professional and Community 2023.5.3 as a stable build on Tuesday, 6 June 2023 at 14:29 UTC. The release upgrades Burp's built-in browser to 114.0.5735.110 on Windows and 114.0.5735.106 on Mac and Linux, and the vendor states...
AutoRepeater is a Burp Suite extension by Justin Moore of NCC Group, version 1.0b, that automatically repeats requests with replacement rules and response diffing. It is positioned as a general-purpose solution for streamlining authorization testing within...
PortSwigger released Burp Suite Professional / Community 2023.6 on 7 June 2023, introducing BChecks - custom scan checks that users create and import using a custom definition language, which Burp Scanner runs alongside its built-in scanning routine. The...
PortSwigger Director of Research James Kettle describes how he picks security research topics, using his web race conditions work as a case study: after one concept proved unrealistic and a second consumed six weeks before failing, he adapted existing...
PortSwigger released Burp Suite Professional and Community 2023.5.4 on Thursday, 15 June 2023, fixing an issue that prevented Burp's browser from starting on some Linux distributions. The release also upgraded Burp's built-in browser to 114.0.5735.133 for...
PortSwigger released Burp Suite Professional and Community 2023.6.1 as an Early Adopter build on Thursday, 15 June 2023 at 12:24 UTC. The release upgrades Burp's built-in browser to 114.0.5735.133 for Mac and Linux and 114.0.5735.133/134 for Windows, and...
PortSwigger researcher Tom Shelton-Lefley describes removing the merge behavior from Burp Scanner's crawler, a graph homomorphism problem he calls NP-hard that collapsed redundant subgraphs but made the code hard to read and maintain. The removal was...
CSurfer is a Burp Suite extension, version 1.1a by A. Saafan and last updated 22 June 2023, that automatically handles anti-CSRF tokens and hides the mechanism from the browser or other tool using Burp. It tracks the most recent token received in a...
PortSwigger lists a Burp Suite extension, authored by Ashkan Jahanbakhsh and last updated 22 June 2023, that adds a tab to Burp's main UI for testing a server for the Heartbleed bug and dumping data retrieved from the server's memory if it is vulnerable....
A third-party Burp extension by author Dbrwsky, version 0.4.1 and last updated 22 June 2023, runs the Nuclei Scanner directly from Burp and converts its JSON results into Burp issues. Users send a URL from the target field or Burp history via Extensions >...
A Burp Suite extension called Header Issue Reporter reads the entire Burp Proxy History and extracts all headers from requests and responses, showing which headers exist for every host and endpoint. It flags header-related issues the user selects via...
PortSwigger released Burp Suite Professional/Community 2023.6.2 on 29 June 2023, introducing BChecks, custom scan checks written in a custom definition language that Burp Scanner runs alongside its built-in scanning routine. The release also adds GraphQL...
PortSwigger released BChecks into beta, a scripting language for Burp Suite Professional that lets users build custom scan checks on the existing scanning engine faster than writing a BApp extension. The post illustrates the language with an example BCheck...
PortSwigger released Burp Suite Enterprise Edition 2023.6 on 3 July 2023, adding CI-driven scans that run Burp Scanner from a Docker container in CI/CD environments such as Jenkins, TeamCity, and GitHub Actions. The release also lets users add headers and...
PortSwigger announced that scripted scan checks, called BChecks, are fully available with the 2023.6 release of Burp Suite Professional, and it is running a competition for users to submit their own. The competition opens Monday 3 July, pull requests will...
PortSwigger added GraphQL checks to Burp Scanner that automatically detect known and hidden GraphQL endpoints, flag when introspection or suggestions are enabled, and report endpoints that fail to validate content type. The scanner also reports when a...
Logger++ is a multithreaded logging extension for Burp Suite, authored by Corey Arthur of NCC Group at version 3.20.0 and last updated 06 July 2023. It logs requests and responses from all Burp Suite tools, supports advanced filters and a built-in grep...
PortSwigger released Burp Suite Enterprise Edition 2023.6.1 on Friday, 7 July 2023, a maintenance update that fixes several bugs. The release fixes an issue with the macOS installer, removes an unused Log4J library that could trigger security alerts, and...
PortSwigger researcher Gareth Heyes showed that Chrome's new HTML popover functionality, which fires the ontoggle and onbeforetoggle events without JavaScript, can be used to execute XSS inside hidden inputs and meta elements. Heyes found that a single...
A third-party Burp Suite extension, GAT Core Integration version 1.0.1 by Julio C. Almeida, lets users configure an API URL and token and then send issues from Burp Scanner's Target tab to GAT Core via a right-click option. After sending, the Extender...
PortSwigger's July 2023 roadmap for Burp Suite lists planned and in-progress work including a BCheck testing tool, code-your-own view filters, scanner auto configuration, service worker and WebSocket crawling, API scanning improvements, and fewer browser...
PortSwigger released Burp Suite Enterprise Edition 2023.7 on 20 July 2023, improving how the product handles database credentials and TLS certificates for Kubernetes deployments. The release lets users supply a TLS certificate and database credentials...
JS Miner is a Burp Suite extension, version 1.16 and last updated 20 July 2023, that searches static JavaScript and JSON files for interesting information during the initial recon phase of a web application assessment. It runs passive scans automatically...
PortSwigger's BApp Store lists an extension by Michele 'cyberaz0r' Di Bonaventura, version 2.0 and last updated 20 July 2023, that checks for the IIS Tilde Enumeration/IIS short name (8.3) disclosure vulnerability and exploits it by enumerating all short...
PortSwigger shortlisted ten community-created BChecks for Burp Scanner, scripted scan checks that let users build customized scans without advanced programming, and opened voting by Twitter like or GitHub thumbs up until midnight on 31 July. The shortlist...
PortSwigger released Burp Suite Professional/Community 2023.7.1 on 25 July 2023, adding the ability to customize the layout of Burp's top-level tabs, with preferences remembered across sessions. The release also includes Burp Scanner improvements, minor...
PortSwigger released Burp Suite Professional/Community 2023.8 on 27 July 2023, adding HTTP/1 connection reuse in Intruder, intermediate CA certificate support for PKCS#11 hardware tokens and smart cards, a trust/untrust prompt for opening third-party...