Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research released SignSaboteur, an open source Burp Suite extension that edits, signs, verifies, and attacks signed web tokens including Django, Flask, and Express formats, with automatic detection and in-line editing of tokens in HTTP...
PortSwigger released Burp Suite Professional/Community 2024.4.4 on 23 May 2024, adding audit item prioritization, endpoint authentication configuration for API scans, and a new web cache deception scan check. The release also drops crawler requests to...
PortSwigger released Burp Suite Professional/Community 2024.5 on 23 May 2024, adding Burp Scanner support for WebSockets, WebSocket match and replace rules, and a formatted "See as events" view for editing recorded logins without hand-editing JSON. The...
PortSwigger's BApp Store lists CookieMonster, a Burp Suite extension by Simon Baeg, version 1.0.0, last updated 23 May 2024, that filters cookies in requests using the categorized Open-Cookie-Database. By default it filters cookies marked non-functional in...
PortSwigger released Burp Suite Enterprise Edition 2024.5 on 24 May 2024, adding multi-factor authentication that administrators can enable for all users via Settings, with users prompted to set up MFA at their next login. The release also adds...
PortSwigger added support for custom columns in Burp Suite, letting users surface chosen elements of HTTP requests in tables using code snippets called bambdas. The research team shared examples ranging from parsing GraphQL operations out of request bodies...
PortSwigger released Burp Suite Enterprise Edition 2024.5.1 on 30 May 2024 to fix a bug that caused licensing issues after upgrading to version 2024.5 in Windows environments. The release notes instruct affected users to re-upload their license key when...
PortSwigger released Burp Suite Professional and Community 2024.4.5 as a stable release on Friday, 31 May 2024 at 10:02 UTC. The release upgrades Burp's browser to Chromium 125.0.6422.112 for Windows, Linux, and Mac, and the upgrade includes a security...
PortSwigger released Burp Suite Professional and Community 2024.5.1 on 31 May 2024, upgrading Burp's browser to Chromium 125.0.6422.112 on Windows, Linux, and Mac, an upgrade that includes a security fix. The release also fixes a bug where proxy settings...
PortSwigger Research updated its XSS cheat sheet with community-contributed event vectors, including a Safari-only vector using the onwebkitplaybacktargetavailabilitychanged event on audio and video tags submitted by @amirmsafari. The update also added the...
PortSwigger released Burp Suite Professional and Community 2024.5.2 as an Early Adopter build on 12 June 2024. The release upgrades Burp's browser to Chromium 126.0.6478.36 on Windows and Mac, and to 125.0.6422.141 on Linux. What's compelling: The bundled...
PortSwigger's BApp Store lists a Burp extension by Enes Saltik, version 1.0, that generates FFUF commands, last updated 12 June 2024. The listing carries no rating or popularity figures and states that extensions are written by third-party Burp users, with...
The Swagger Parser is a Burp Suite extension, version 1.0 by Enes Bulut of Trendyol, that parses Swagger documents and lets users view the parsed requests in a table and send them to Repeater, Intruder, and Scanner. It was last updated on 14 June 2024 and...
PortSwigger released Burp Suite Professional/Community 2024.5.3 on 18 June 2024, adding Burp Scanner support for WebSockets so it can crawl sites that rely on them, including WebSocket-based recorded logins, though the scanner does not scan WebSocket...
PortSwigger released Burp Suite Professional and Community 2024.5.4 as a stable build on Thursday, 27 June 2024 at 09:45 UTC. The release fixes a bug with disk-based project files, where in version 2024.5.3 the Target tab was not visible for projects with...
PortSwigger announced a strategic investment from growth equity firm Brighton Park Capital, which becomes a minority shareholder while PortSwigger retains overall control of the business. The company said the funding will accelerate product development,...
PortSwigger released Burp Suite Professional 2024.6 on 27 June 2024, adding active and passive scan checks that detect OpenAPI definitions during scans and while browsing, using a list of common OpenAPI definition file names and locations. The release also...
PortSwigger Research announced three talks for Black Hat USA and DEF CON 32: James Kettle on timing attacks that can detect a sub-millisecond differential in ten seconds, Gareth Heyes on RFC-compliant email addresses that bypass defenses and spoof domains,...
PortSwigger released Burp Suite Professional and Community 2024.5.5 as a stable version on Tuesday, 2 July 2024 at 14:55 UTC. The release upgrades Burp's browser to Chromium 126.0.6478.127 for Windows and Mac and 126.0.6478.126 for Linux. What's...
PortSwigger released Burp Suite Professional and Community 2024.6.1 on 5 July 2024, upgrading Burp's browser to Chromium 126.0.6478.127 on Windows and Mac and 126.0.6478.126 on Linux. The release also fixes a bug that was preventing effective parsing of...
PortSwigger researcher Zak Fedotkin published research on creating hybrid PDFs that abuse widget annotations to produce different displayed content across PDF renderers, using a proof-of-concept invoice showing £399 in Safari and macOS Preview but £999 in...
PortSwigger released Burp Suite Professional and Community 2024.6.3 as an Early Adopter build on Monday, 15 July 2024. The release fixes a bug that could potentially cause the scanner to stop sending requests for long periods of time. What's compelling: A...
PortSwigger released Burp Suite Enterprise Edition 2024.6 on 16 July 2024, adding dedicated API scanning that lets users upload OpenAPI (Swagger) definition files or point to a live link that is re-fetched at each scan. The release also parses Basic,...
PortSwigger's Replicator is a Burp extension that lets a pen tester package findings into a Replicator file, each containing a request, associated session rules or macros, and logic to detect the vulnerability's presence. Developers open the file in Burp...
PortSwigger's BApp Store lists a Burp Suite extension called Bulk Send to Repeater, authored by Karl Schuttler of White Oak Security, version 1.0.1, last updated 29 July 2024. The extension adds context menus to Burp's request viewers so requests can be...
PortSwigger released four built-in API scanning features for Burp Suite Professional and Enterprise Edition, letting users upload OAS definition files directly, check for exposed hosted OAS definitions, add HTTP headers when crawling APIs, and scan APIs...
PortSwigger released Burp Suite Professional/Community 2024.7 on 1 August 2024, adding performance upgrades for large responses and projects with many Repeater tabs, an Intercept feature that lists messages in the order they were sent, and a Scanned...
PortSwigger released Burp Suite DAST Enterprise Edition 2024.6.1 as a stable release on Tuesday, 6 August 2024 at 14:49 UTC. The release fixes a bug that was affecting recorded login replays. What's compelling: Recorded login replays feed authenticated...
PortSwigger released Burp Suite Professional 2024.6.4 on 7 August 2024, adding active and passive scan checks that detect OpenAPI definitions during scans and while browsing, using a list of common definition file names and locations. The release also adds...
PortSwigger released Burp Suite Professional and Community 2024.7.1 as an Early Adopter build on Wednesday, 7 August 2024. The release upgrades Burp's embedded browser to Chromium 127.0.6533.73 on Windows and Mac and 127.0.6533.72 on Linux. What's...