Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Enterprise Edition 2023.9 on 2 October 2023, adding three new columns to the bulk import CSV template so login details can be included when sites are imported in bulk. The release also raises the character limit for custom...
PortSwigger Director of Research James Kettle describes building a custom Burp Suite extension that sends a request ten times sequentially and then ten times in under 1ms using the single-packet attack, reporting any difference in status code to probe for...
PortSwigger's BApp Store lists a Burp Extender plugin, version 0.2.4 by SilentSignal, that registers as an Active scanner check for Log4Shell, CVE-2021-44228, and generates two payload types: one expanding only the hostname, and a more complex one that...
PortSwigger released Burp Suite Enterprise Edition 2023.9.1 on Friday, 13 October 2023, a maintenance release that fixes two bugs. One fix addresses an issue that had prevented some very long-running scans from completing, and the other resolves an error...
PortSwigger released Burp Suite Professional/Community 2023.10.2.2 on 16 October 2023, adding the ability to test BChecks from within the editor using pre-selected requests and responses as test cases, plus a blank BCheck template. The release also adds...
PortSwigger released Burp Suite Professional/Community 2023.10.3 on 16 October 2023, adding Bambdas custom Java-code filters to the Proxy HTTP history tab, BChecks export for sharing between Burp instances, and notes in more areas of Burp. The release also...
PortSwigger lists a Burp extension, version 1.0.1 by Kai Mannion, that incorporates the company's cross-site scripting cheat sheet into Burp Suite, with payload data updated via GitHub when the extension loads and persisted globally if GitHub is...
PortSwigger researcher James Kettle detailed the single-packet attack, a technique that completes multiple HTTP/2 requests in one TCP packet to eliminate network jitter and make remote race conditions as exploitable as local ones. The post extends the...
PortSwigger released Burp Suite Professional and Community 2023.10.2.3 on Friday, 20 October 2023, upgrading the built-in browser to 118.0.5993.88 for Mac and Linux and 118.0.5993.88/.89 for Windows. The release notes state the update contains a security...
PortSwigger released Burp Suite Professional and Community 2023.10.3.1 as an Early Adopter build on Friday, 20 October 2023 at 12:39 UTC. The release upgrades Burp's built-in browser to 118.0.5993.88 for Mac and Linux and 118.0.5993.88/.89 for Windows, and...
PortSwigger released Burp Suite Professional and Community 2023.10.2.4 as a stable build on Friday, 27 October 2023 at 13:12 UTC. The release upgrades Burp's built-in browser to Chromium 118.0.5993.117 for Mac and Linux and 118.0.5993.90 for...
PortSwigger released Burp Suite Professional and Community 2023.10.3.2 as an Early Adopter build on Friday, 27 October 2023 at 13:12 UTC. The release upgrades Burp's built-in browser to Chromium 118.0.5993.117 for Mac and Linux and 118.0.5993.90 for...
PortSwigger released Burp Suite Professional and Community 2023.10.2.5 as a stable build on Monday, 6 November 2023 at 15:53 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (x64). The release upgrades Burp's...
PortSwigger released Burp Suite Professional and Community 2023.10.3.3 as an Early Adopter build on Monday, 6 November 2023. The release upgrades Burp's built-in browser to Chromium 119.0.6045.123 for Mac and Linux and 119.0.6045.123/.124 for...
PortSwigger released Burp Suite Professional/Community 2023.10.3.4 on 9 November 2023, adding Bambdas - small Java code snippets - to the Proxy HTTP history filter so users can write custom filters. The release also enables BChecks export, expands the...
PortSwigger introduced Bambdas, a feature that lets users customize Burp Suite directly from the UI using small snippets of Java, exposing core behind-the-scenes functionality for the first time. The first Bambda enables custom filters for the Proxy HTTP...
PortSwigger released Burp Suite Professional / Community 2023.11.1 on 14 November 2023, adding manual testing tools for GraphQL APIs, syntax highlighting in the BChecks editor, and an experimental scan check for broken access control. The GraphQL features...
PortSwigger released Burp Suite Enterprise Edition 2023.10 on 16 November 2023, adding configuration options for CI-driven scans that let users specify upstream proxies and platform authentication information in the YAML file. The release also moves the...
PortSwigger released Burp Suite Professional and Community 2023.11.1.1 as an Early Adopter build on Friday, 17 November 2023 at 10:11 UTC. The release upgrades Burp's built-in browser to 119.0.6045.159 for Mac and Linux and 119.0.6045.159/.160 for...
PortSwigger released Burp Suite Professional and Community version 2023.10.3.6 as a stable release on Monday, 20 November 2023 at 11:59 UTC. The release contains minor bug fixes and is available as installers for Windows (x64), macOS (Apple silicon and...
ParaForge is a Burp Suite extension, version 0.1 by Sourav Kalal/AnoF, that extracts parameters and endpoints from requests to build custom wordlists for fuzzing and enumeration. It was last updated on 23 November 2023, carries an overall system impact...
Pentest Mapper is a Burp Suite extension, version 1.7.3 and last updated 23 November 2023, that integrates Burp's request logging with a custom application testing checklist. It lets testers map application flows and connect each flow or API call to a...
PortSwigger released Burp Suite Professional and Community 2023.10.3.7 on Monday, 4 December 2023, upgrading the built-in browser to Chromium 119.0.6045.199 for Mac and Linux and 119.0.6045.199/.200 for Windows. The release notes state the upgrade patches...
PortSwigger released Burp Suite Professional and Community 2023.11.1.2 as an early adopter build on Monday, 4 December 2023. The release upgrades Burp's built-in browser to Chromium 119.0.6045.199 for Mac and Linux and 119.0.6045.199/.200 for Windows,...
PortSwigger researcher Gareth Heyes published a technique for blind CSS exfiltration that extracts data from pages where JavaScript is blocked by CSP or filters like DOMPurify, using attribute selectors, CSS variables, and background-image requests to an...
PortSwigger released Burp Suite Professional/Community 2023.11.1.3 on 11 December 2023, adding manual testing tools for GraphQL APIs, BChecks syntax highlighting, and an experimental broken access control scan check. The GraphQL features add a dedicated...
PortSwigger Research published a set of Bambdas - mini-extensions coded directly inside Burp Suite's proxy - that flag HTTP endpoints exhibiting unusual behavior, each of which flagged at least one real website. The examples include redirect responses with...
A Burp Suite extension by Nick Coblentz, version 0.1.7 and last updated 13 December 2023, identifies key information from requests to AWS Cognito, provides several passive scan checks, and suggests HTTP request templates for exploiting several known...
PortSwigger is extending Bambdas, its small code snippets for customizing Burp Suite, beyond the Proxy HTTP history filter to new custom filters for the Logger view and WebSockets history. Those filters arrive on the early adopter channel in December and...
PortSwigger released Burp Suite Professional/Community 2023.12.1 on 14 December 2023, adding Bambdas to the Proxy WebSockets history filter and Logger View filter, plus the ability to duplicate Repeater tabs multiple times. The release also redesigned the...