Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Enterprise Edition 2023.12 on 20 December 2023, introducing BChecks, custom scan checks that extend and tailor Burp Scanner to an application's framework and provide targeted coverage for new and novel vulnerabilities....
Header Snipper is a Burp Suite extension, version 1.0 by Eric Labrador Sainz and last updated 04 January 2024, that removes headers from requests with one click through an added message editor view where users configure which headers to snip and see the...
PortSwigger Research has opened nominations for its annual community-voted top 10 web hacking techniques, a project running since 2006, with submissions accepted as a URL plus an optional comment on what is novel. Organizers say they will filter out...
PortSwigger's BApp Store lists a Burp extension called URL Fuzzer, version 1.0 by author Akenofu, last updated 09 January 2024, which fuzzes URLs with all available ASCII characters to identify parser inconsistencies. The extension is based on work by...
Kollaborator Module Builder is a Burp Suite extension, version 0.0.1 by author mbkunal and last updated 09 January 2024, that lets users write a Python script in a text area under the KMB tab to handle Collaborator interactions. The extension automatically...
PortSwigger released Burp Suite Professional and Community 2023.11.1.4 as a stable build on Wednesday, 10 January 2024 at 15:38 UTC. The release upgrades Burp's built-in browser to Chromium 120.0.6099.199 for Mac and Linux, and 120.0.6099.199/200 for...
PortSwigger released Burp Suite Professional and Community version 2023.12.1.1 on 10 January 2024, upgrading Burp's built-in browser to Chromium 120.0.6099.199 on Mac and Linux and 120.0.6099.199/200 on Windows. The release also adds minor UI improvements,...
PortSwigger's BApp Store lists a Burp Suite extension called Passkey Scanner, authored by Alex Cowperthwaite at version 1.0 and last updated 16 January 2024, that recognizes and scans Passkey (WebAuthn) protocols and detects security issues. The listing...
PortSwigger released Burp Suite Enterprise Edition 2024.1 on Wednesday, 17 January 2024, adding support for Java 21, which the release notes describe as the latest Java release with long term support, bringing performance improvements and security...
PortSwigger released Burp Suite Professional and Community 2023.11.1.5 as a stable build on Wednesday, 17 January 2024 at 13:28 UTC, with installers for Windows, macOS, and Linux plus a JAR. The release upgrades Burp's built-in browser to Chromium...
PortSwigger released Burp Suite Professional / Community 2023.12.1.2 on 17 January 2024, a minor update with bug fixes for Burp Scanner and changes to notifications. The release fixes an issue in how Burp Scanner handles insertion points that was causing...
PortSwigger researcher Gareth Heyes showed that the Java compiler treats unicode escapes like \u0022 as real syntax inside source code strings, so an encoded double quote closes a string and lets Runtime.getRuntime() execute a command. Heyes applied this...
PortSwigger released Burp Suite Professional / Community 2024.1.1 on 26 January 2024, adding an Insertion points panel to Burp Scanner's Audit items tab that lists a request's insertion points in a tree view categorized as Detected, Moved, or Added, with...
PortSwigger released Burp Suite Professional/Community 2023.12.1.3 on 26 January 2024, adding Bambdas to the Proxy WebSockets history filter and Logger View filter, the ability to duplicate Repeater tabs multiple times, a Connection ID column in Logger,...
PortSwigger released Burp Suite Enterprise Edition 2024.1.1 on 2 February 2024, upgrading Burp Scanner to version 2023.12.1.3 with an experimental new scan check for broken access control vulnerabilities. The check is disabled at Normal audit accuracy...
PortSwigger has brought BChecks, its custom-created scan checks, to Burp Suite Enterprise Edition after previously releasing them to Burp Suite Professional. BChecks can be imported from a GitHub repository or written in Burp Suite Professional and applied...
PortSwigger released updates to BChecks, its scripting language for building custom scan checks in Burp Suite, adding syntax highlighting and a testing tool that runs specific requests and responses against a BCheck in a simulated environment. The company...
PortSwigger released Burp Suite Professional and Community 2023.12.1.4 as a stable build on Thursday, 8 February 2024 at 15:30 UTC. The release upgrades Burp's built-in browser to version 121.0.6167.160 on Mac and Linux and 121.0.6167.161 on...
PortSwigger released Burp Suite Professional and Community version 2024.1.1.1 on 8 February 2024, upgrading Burp's built-in browser to 121.0.6167.160 on Mac and Linux and 121.0.6167.161 on Windows. The release also fixes a bug that sometimes caused notes...
PortSwigger released Burp Suite Professional and Community Edition version 2023.12.1.5 as a stable release on Tuesday, 13 February 2024 at 14:30 UTC. The release contains some minor bug fixes, with downloads offered for JAR, Linux (ARM and x64), macOS...
PortSwigger's BApp Store lists JScriptor, a third-party Burp Suite extension by Nguyen Duy Quoc Khanh, version 2.01, last updated 13 February 2024, which imports JavaScript code and runs it like Postman's Pre-script and Post-script, showing the script...
PortSwigger Research published its 17th annual Top 10 Web Hacking Techniques list for 2023, drawing a record 68 community nominations that were narrowed to 15 finalists and then voted on by an expert panel of Nicolas Grégoire, Soroush Dalili,...
PortSwigger released Burp Suite Professional and Community 2024.1.1.2 as an Early Adopter build on Wednesday, 21 February 2024, offering performance improvements when proxying requests through Burp plus minor bug fixes. The release fixes loss of notes and...
The OpenAPI Parser is a Burp Suite extension, authored by Alexandre Teyar of Aegis Cyber and listed at version 4.1, that streamlines assessment of web services using OpenAPI-based APIs. It was last updated 22 February 2024, carries an overall system impact...
PortSwigger released Burp Suite Professional and Community 2024.1.1.3 as an Early Adopter build on Friday, 23 February 2024 at 15:57 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release...
PortSwigger lists a Burp Suite extension called Source Mapper, version 1.3, last updated 26 February 2024, that injects offline source maps so minified JavaScript and CSS can be read and debugged in the browser's developer tools. The extension serves...
PortSwigger released Burp Suite Professional and Community 2024.1.1.4 on 1 March 2024, adding an Insertion points panel to Burp Scanner's Audit items tab that lists insertion points in a tree view categorized as Detected, Moved, and Added, with status...
PortSwigger released Burp Suite Professional/Community 2024.2.1 on 1 March 2024, adding API scanning that lets users upload an OpenAPI v3.0.x definition from a local file to seed a scan and view or configure the endpoints to be scanned. The release also...
PortSwigger released Burp Suite DAST Enterprise Edition 2024.1.1.1 on Monday, 4 March 2024 at 11:50 UTC. The release reduces the number of browsers Burp Scanner creates during the audit phase, lowering demand on system resources while maintaining scan...
PortSwigger researcher Gareth Heyes described form hijacking, a technique that uses an HTML injection to set a form's action or formaction attribute so credentials are posted to an attacker's server, bypassing CSP when the form-action directive is missing....