Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research released a Burp Suite plugin called Trusted Types checker, version 1.0, last updated 08 January 2025, which checks for a number of misconfigurations of the Trusted Types browser functionality. Trusted Types restricts which content can...
PortSwigger released Burp Suite DAST Enterprise Edition 2024.11.2 on Thursday, 9 January 2025, a release that fixes a security issue. The release also addresses a performance issue with database cleanups for self-hosted users running MariaDB or MySQL...
PortSwigger detailed three ways to extend Burp Suite: Bambdas, small code snippets for custom filters and match-and-replace rules; BChecks, a purpose-built language for custom scan checks available in Professional and Enterprise Edition; and Extensions...
PortSwigger's BApp Store lists Customizer, a Burp Suite extension by Corey Arthur (version 1.1.0, last updated 15 January 2025) that lets users apply third-party IntelliJ Platform themes in Burp after version 2020.12 replaced its old Look and Feel classes...
PortSwigger researcher Zak Fedotkin published a technique called the "cookie sandwich" that bypasses the HttpOnly flag on certain servers by placing quotes and legacy cookies like $Version inside cookie values to make the server misparse the Cookie header....
PortSwigger released Burp Suite Professional / Community 2024.12.1 on 24 January 2025, adding a capture filter to the Burp Intruder attack results window so users can choose which response types Intruder captures during an attack. The release also adds...
PortSwigger released Burp Suite Professional/Community 2025.1 on 24 January 2025, adding an Auto-pause attack setting to Burp Intruder that pauses an attack when a specified expression appears in or is missing from a response, CSV export for Burp...
PortSwigger's article lays out four challenges for AppSec teams scaling in 2025: growing application and API portfolios, a widening gap between security staff and responsibilities, security becoming a bottleneck in faster software delivery, and rising...
PortSwigger researcher Gareth Heyes published an article on Unicode codepoint truncation, also called a Unicode overflow attack, which occurs when a server tries to store a Unicode character in a single byte and an overflow can be crafted to produce a...
PortSwigger Research lists a Burp Suite extension, authored by Zakhar Fedotkin, that mutates ciphers to bypass TLS-fingerprint based bot detection. The extension changes network settings under Settings -> Network -> TLS to select "Use custom protocols and...
PortSwigger lists a Burp Suite extension, Burp Extension for AWS SigV4 Signing, version 2.1.0, last updated 29 January 2025, that lets a user create a profile specifying which credentials sign requests. The extension checks each request passing through...
PESD Exporter is a Burp Suite extension, authored by Francesco Lacerenza and at version 2.0, that converts proxy traffic into interactive sequence diagrams called Proxy Enriched Sequence Diagrams, carrying HTTP details as explorable metadata. It supports...
A third-party Burp Suite extension called License Title Cleaner, authored by Ronen1n and last updated 31 January 2025, modifies the Burp Suite window title by removing the " - licensed to .*" portion once installed. PortSwigger states that extensions are...
Collabfiltrator is a Burp Suite extension, version 4.0.1, that assists in exfiltrating blind Remote Code Execution and SQL injection output over DNS via Burp Collaborator. It was authored by Adam Logue, Frank Scarpella, Jared McLaren and Ryan Griffin, last...
PortSwigger's BApp Store lists a third-party Burp extension called JavaScript Encode As, version 1.0 by author ret2desync, last updated 31 January 2025, that encodes strings in JavaScript format (Unicode or Hex) for use within JSON and JavaScript. The...
PortSwigger Research published its 18th annual Top 10 Web Hacking Techniques list for 2024, drawn from 121 community nominations that were filtered to 103 entries and then narrowed to fifteen finalists by community vote. An expert panel including Nicolas...
PortSwigger released Burp Suite Enterprise Edition 2025.1.1 on 12 February 2025 to fix a bug introduced in 2025.1 that prevented certain users from creating sites, and 2025.1 was withdrawn while the fix was made. The 2025.1 release it restores adds bulk...
PortSwigger released Burp Suite Professional/Community 2025.1.1 on 13 February 2025, adding an Auto-pause attack setting to Burp Intruder that pauses an attack when a specified expression appears in or is missing from a response. The release also adds CSV...
PortSwigger's Burp Suite 2025.2 release adds built-in AI support to the Montoya API, letting extensions interact with a large language model through PortSwigger's AI platform without external API keys, with costs debited from a user's AI credit balance....
PortSwigger announced AI-powered extensions in Burp Suite Professional, letting developers integrate AI capabilities through the Montoya API, with all AI interactions managed within PortSwigger's trust boundary and data not used for training. Gareth Heyes...
PortSwigger released Burp AI, its first AI-enhanced functionality for Burp Suite, live for Burp Suite Professional users on version 2025.2.3, with every Professional user given 10,000 free AI credits. The company argues AI should augment rather than...
PortSwigger released Shadow Repeater, a Burp Suite Professional extension that monitors Repeater requests, identifies the parameters a tester is changing, and sends the extracted payloads to an AI model to generate variants, which it then sends to the...
PortSwigger released Burp Suite Professional and Community 2025.1.2 on Friday, 21 February 2025, fixing a bug where opening Burp's browser settings would sometimes crash the browser. The release also upgrades Burp's browser to Chromium 133.0.6943.127 on...
PortSwigger's BApp Store lists SpoofProof, a Burp Suite extension by Chetanya Sharma (AggressiveUser), version 1.0.3, last updated 24 February 2025, designed to verify email domain spoofing vulnerabilities and validate DNS-based email security...
PortSwigger released Burp Suite Professional and Community 2025.2.1 on 24 February 2025, adding the ability to scan Postman Collections (v2.1.0) so Burp parses requests, authentication methods, parameters, and collection variables for API coverage. The...
PortSwigger announced a strategic partnership in which SAP has selected Burp Suite Enterprise Edition as its preferred Dynamic Application Security Testing solution across its web application portfolio and online services. SAP, whose platforms include SAP...
PortSwigger Research describes a Burp Suite extension called Timestamp Injector that replaces an outdated timestamp value in an HTTP request with the string "UnixTimeS", and Burp then injects the current Epoch time at that location. The extension, authored...
PortSwigger lists a Burp Suite extension called HTML Content Extractor, version 1.1, by Ceylan Bozogullarindan, last updated 28 February 2025, that applies CSS selectors to pull specific parts of HTML content from the HTTP message viewer. The extension...
PortSwigger released Burp Suite Professional and Community Edition 2025.1.3 as a stable build on Tuesday, 4 March 2025 at 13:15 UTC. The release contains some minor bug fixes, with installers offered for JAR, Linux (ARM and x64), macOS (Apple silicon and...
PortSwigger released Burp Suite Professional and Community 2025.1.4 on 7 March 2025, adding the ability to scan Postman Collections (v2.1.0). Burp parses an uploaded collection to identify requests, authentication methods, parameters, and collection...