Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger lists a third-party Burp extension called Copy to BCheck, authored by Matheus Vrech at version 1.1 and last updated 28 July 2023, that formats requests copied from the Repeater tool into bcheck scripts. The extension generates only simple...
PortSwigger released Burp Suite Enterprise Edition 2023.7.2 on Monday, 31 July 2023 at 14:48 UTC, available as a Helm chart and as Linux, macOS, and Windows installers plus scanner and server component updaters. The release fixes a bug that occurred when...
PortSwigger released Burp Suite Professional and Community 2023.7.3 as a stable build on Friday, 4 August 2023 at 13:12 UTC. The release upgrades Burp's built-in browser to 115.0.5790.170 for Mac and Linux and 115.0.5790.170/.171 for Windows, and the...
PortSwigger released Burp Suite Professional and Community 2023.8.1 as an Early Adopter build on Friday, 4 August 2023 at 13:12 UTC. The release upgrades Burp's built-in browser to 115.0.5790.170 for Mac and Linux and 115.0.5790.170/.171 for Windows, and...
PortSwigger researcher James Kettle introduced new classes of web race condition attacks that go beyond limit-overrun exploits, demonstrating them against multiple high-profile websites and the Devise authentication framework for Rails. He also detailed...
PortSwigger Research's James Kettle presented "Smashing the state machine: the true potential of web race conditions" at Black Hat USA '23 and DEF CON 31, introducing multiple new classes of web race condition beyond limit-overrun exploits. The work also...
PortSwigger released Burp Suite Professional/Community 2023.9.1 on 10 August 2023, adding a Repeater single-packet attack that synchronizes parallel requests to arrive in full at the same time, based on James Kettle's Black Hat USA 2023 talk "Smashing the...
PortSwigger's BApp Store lists a third-party Burp extension called Response Pattern Matcher, version 2.0.1, last updated 15 August 2023, which uses a list of payloads to pattern match on HTTP responses and flag potentially vulnerable areas. The description...
PortSwigger's BApp Store lists a Burp Suite extension called Error Message Checks, version 2.0.5, authored by August Detlefsen and last updated 15 August 2023, which passively reports detailed server error messages that are often not visible during normal...
PortSwigger released Burp Suite Professional/Community 2023.9.2 on 17 August 2023, upgrading Burp's built-in browser to Chromium 116.0.5845.96 on Mac and Linux and 116.0.5845.96/.97 on Windows. The release also fixes a bug in Burp Scanner where the crawler...
PortSwigger released Burp Suite Professional and Community 2023.9.3 on 25 August 2023, upgrading Burp's built-in browser to version 116.0.5845.110 on Mac and Linux and 116.0.5845.110/.111 on Windows. The release also fixes a bug in Burp Scanner that...
PortSwigger released Burp Suite Professional/Community 2023.10 on 25 August 2023, adding the ability to unpack Brotli-compressed messages in the Proxy and Repeater tools and Organizer functionality to the Montoya API. The release also adds Burp Scanner...
PortSwigger released Burp Suite Professional and Community 2023.9.4 as a stable build on Friday, 1 September 2023 at 07:17 UTC. The release upgrades Burp's built-in browser to version 116.0.5845.140 for Mac and Linux and 116.0.5845.140/.141 for Windows,...
PortSwigger released Burp Suite Professional and Community 2023.10.1 as an Early Adopter build on Friday, 1 September 2023 at 07:17 UTC. The release upgrades Burp's built-in browser to 116.0.5845.140 for Mac and Linux and 116.0.5845.140/.141 for Windows,...
PortSwigger released Burp Suite Enterprise Edition 2023.8 on 1 September 2023, adding user activity logging that records user actions and successful logins and can be downloaded as a timestamped CSV file. The release also surfaces Platform authentication...
PortSwigger published a case study on Sprocket Security, a US continuous penetration testing firm that uses Burp Suite Professional and Enterprise Edition and began experimenting with the BChecks scripting feature after tester Nate Fair saw a PortSwigger...
A Burp Suite extension called WAF Bypadd, authored by Julian J. M and last updated 07 September 2023, pads HTTP requests with dummy data to bypass Web Application Firewalls. The approach exploits the fact that many WAFs only analyze the first few kilobytes...
A Burp Suite extension called Type Confusion Scanner, authored by certuscyber and last updated 11 September 2023, resubmits any JSON body in an HTTP request with integer and boolean values replaced by their string equivalents. If the server returns a...
PortSwigger's BApp Store lists Conditional Match and Replace, a Burp Suite extension by Daniel Jensen of CyberCX that runs match and replace operations only when a condition is met against a request or response header, body, or both. Rules execute in a...
PortSwigger's Web Security Academy launched learning paths, starting with two: an apprentice-level overview of server-side vulnerabilities and a path focused exclusively on SQL injection. Each path is broken into topics and modules, some containing the...
The HAR Importer is a Burp Suite extension, authored by Fortalice Solutions, LLC and listed at version 1.0, that loads the contents of HAR files into Burp's Sitemap tool for further analysis. HAR files are JSON-formatted archives of a browser's web...
The Session Handler Plus (SH+) is a Burp Suite extension, authored by Vinaya Kumar and last updated 14 September 2023, that adds session handling for JWTs, access tokens, refresh tokens, and CSRF tokens. It also lets custom scripts run through session...
PortSwigger released Burp Suite Professional/Community 2023.10.1.1 on 14 September 2023, adding the ability to unpack Brotli-compressed messages in the Proxy and Repeater tools and Organizer functionality to the Montoya API. The release also added Burp...
PortSwigger released Burp Suite Professional/Community 2023.10.2 on 14 September 2023, adding the ability to test BChecks from within the editor using pre-selected requests and responses as test cases, a blank BCheck template, and a notes feature for...
PortSwigger's BApp Store lists DNS Analyzer, a Burp Suite extension by Timo Longin, version 1.0, that is described as allowing users to find DNS vulnerabilities in web applications. The listing was last updated on 18 September 2023 and notes that...
PortSwigger's BApp Store lists a third-party Burp Suite extension, Magic Byte Selector, that inserts magic bytes into requests so testers can probe file upload checks that validate the first bytes of sent data to identify file type. The listing gives the...
A Burp Suite BApp extension called Encode IP, authored by Eric Labrador Sainz and last updated 25 September 2023, encodes an IP address using a variety of lesser-known encoding techniques. The extension is aimed at testing vulnerabilities such as...
PortSwigger Research explains that DOM Invader, a browser extension for finding DOM-based XSS by instrumenting JavaScript functions, can cause sites to throw exceptions from eval when enabled but not when disabled. The cause is that instrumenting eval...
PortSwigger released Burp Suite Professional and Community 2023.10.1.2 as a stable version on Friday, 29 September 2023 at 12:45 UTC. The release upgrades Burp's built-in browser to 117.0.5938.132 for Mac, Linux, and Windows and contains security fixes,...
PortSwigger released Burp Suite Professional and Community 2023.10.2.1 as an Early Adopter build on Friday, 29 September 2023 at 12:45 UTC. The release upgrades Burp's built-in browser to 117.0.5938.132 for Mac, Linux, and Windows and contains security...