Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Professional and Community 2024.9.2 as an Early Adopter build on Monday, 14 October 2024. The release fixes a bug where project files were sometimes incorrectly saved to the working directory, so a project previously saved...
PortSwigger released Burp Suite Enterprise Edition 2024.9.1 as a stable release on Wednesday, 16 October 2024 at 14:45 UTC. The release fixes a bug that prevented Jira tickets from being raised automatically. What's compelling: Until this patch, teams...
PortSwigger released Burp Suite Enterprise Edition 2024.9.2 as a stable build on Monday, 21 October 2024 at 07:08 UTC. The release notes state that this version improves the performance of API scans. What's compelling: API scans are where dynamic testing...
PortSwigger researcher Gareth Heyes documented that payloads can be concealed in the credentials portion of a URL, which is hidden from the address bar in both Chrome and Firefox and persists through same-origin navigations. Heyes found that document.URL...
PortSwigger released Burp Suite Professional/Community 2024.9.3 on 24 October 2024, adding a redesigned Burp Intruder side panel for editing payload positions, payloads, and attack settings, Bambda-based HTTP match and replace rules, and SOAP API scanning...
PortSwigger released Burp Suite Professional/Community 2024.10 on 29 October 2024, adding a combined scan launcher for web app and API-only scans, SOAP API authentication, customizable uninteresting headers, and limited support for scanning OpenAPI 3.1.x...
PortSwigger Research updated its URL Validation Bypass Cheat Sheet with new IPv4 representations supported by Chrome, Firefox, and Safari, including Partial Decimal Class B and Class A formats and mixed encodings that present each IP segment in...
The Nmap Scanner Burp Suite Extension, authored by Parth Patel at version 1.0 and last updated 30 October 2024, integrates Nmap's network scanning capabilities directly into the Burp Suite interface. It provides a graphical interface for initiating and...
PortSwigger shipped three Burp Suite Enterprise Edition updates - 2024.9 in September, 2024.10 at the end of October, and 2024.11 due in November - adding editable issue severity, an accepted-risk status with notes, a native Splunk integration that streams...
Header Guardian is a Burp Suite extension, authored by OlderMutt and listed at version 1.0, that identifies missing, misconfigured, and unnecessary HTTP security headers in web applications. The listing states that properly configured security headers are...
PortSwigger's BApp Store lists a Burp Suite extension by Maxence Schmitt of Doyensec, version 1.0, last updated 30 October 2024, that passively scans proxy history for query parameters reflected inside the path of another query to find Client-Side Path...
PortSwigger released Burp Suite Professional and Community 2024.9.4 as a stable build on Wednesday, 30 October 2024 at 11:27 UTC. The release upgrades Burp's embedded browser to Chromium 130.0.6723.70 for Windows and Mac and 130.0.6723.69 for...
PortSwigger released Burp Suite Enterprise Edition 2024.10 on 31 October 2024, adding visibility into the crawl paths Burp Scanner discovers, including a list of all URLs found during the crawl phase and whether each was audited and why not. The release...
PortSwigger released Burp Suite DAST Enterprise Edition 2024.10.1 as a stable release on Monday, 4 November 2024 at 13:44 UTC. The release updates the Java Runtime to 21.0.5 and Azul Zulu to 21.38.21, which the vendor states fixes a security issue. What's...
PortSwigger released Burp Suite Professional and Community version 2024.9.5 on 7 November 2024, adding a Default Intruder side panel layout setting that lets users configure the Intruder sidebar independently from other sidebars. The release also fixed a...
Sensitive Discoverer is a Burp Suite extension, authored by CYS4 and at version 4.2.0 as of 15 November 2024, that matches lists of regular expressions against all HTTP messages stored in Burp to find sensitive strings or file extensions. It ships with...
PortSwigger released Burp Suite Professional and Community 2024.10.2 on 25 November 2024, adding a streamlined Intruder layout with a customizable side panel, a combined scan launcher for web apps and APIs, SOAP authentication support, and partial scanning...
PortSwigger released Burp Suite Professional/Community 2024.11 on 25 November 2024, adding site map filter Bambdas, match and replace Bambdas with access to a subset of MontoyaAPI functionality, dynamic authentication tokens for API-only scans, and revised...
PortSwigger released Burp Suite Enterprise Edition 2024.11 on 28 November 2024, adding PDF scan reports and compliance reports compatible with PCI DSS v4.0.1. The release also adds SOAP API scanning, including CI-driven scans via an uploaded WSDL file or...
Reshaper is a Burp Suite extension, version 2.5.3, that lets users trigger actions and reshape HTTP request and response traffic through configurable rules. Rules apply actions called Thens when messages or connections meet criteria called Whens, are...
PortSwigger released Burp Suite Professional and Community 2024.10.3 as a stable version on Friday, 29 November 2024 at 11:27 UTC, available as JAR and installers for Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The...
PortSwigger released Burp Suite Professional and Community 2024.11.1 as an Early Adopter build on Friday, 29 November 2024. The release fixes a bug that was preventing the scan launcher from displaying correctly. What's compelling: A broken scan launcher...
PortSwigger's BApp Store lists OAUTH Scan, a Burp Suite extension by Maurizio Siddu, version 1.2, that provides a way to discover OAuth v2 and OpenID vulnerabilities. The listing was last updated on 03 December 2024, carries an overall system impact rating...
PortSwigger released Burp Suite DAST Enterprise Edition 2024.11.1 as a stable release on Wednesday, 4 December 2024 at 14:38 UTC. The release fixes an issue with link expiration during password resets and user invitations. What's compelling: The fix...
PortSwigger researcher Zak Fedotkin published research showing that legacy cookie-parsing features, including the RFC2109 $Version attribute, quoted cookie values, comma separators, and multiple Cookie headers, create parser discrepancies that can be...
PortSwigger released SignSaboteur, a Burp Suite extension for editing, signing, verifying, and attacking signed tokens, supporting formats including Django TimestampSigner, ItsDangerous, Express cookie-session, OAuth2 Proxy, Tornado signed cookies, Ruby...
PortSwigger's BApp Store lists a Burp Suite extension called Batch Scan Report Generator, version 0.4, by Jeffrey Cap (Bort_Millipede), last updated 12 December 2024, which generates multiple scan reports by host in a few clicks. PortSwigger notes the...
PortSwigger released Burp Suite Professional/Community 2024.12 on 19 December 2024, adding a capture filter to the Burp Intruder attack results window and automatic Base64 and Q-encoded decoding of SMTP messages in Burp Collaborator. The release also...
PortSwigger released Burp Suite Professional / Community 2024.11.2 on 19 December 2024, adding site map filter Bambdas, match and replace Bambdas with access to a subset of MontoyaAPI functionality, dynamic authentication tokens for API-only scans, and...
PortSwigger Research has opened nominations for the annual community vote on the top 10 new web hacking techniques of 2024, a project running since 2006. Submissions require only a URL to the research plus an optional comment on what is novel, and the...