Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger marked two months since introducing five AI capabilities into Burp Suite, including automated follow-up analysis of scanner-identified vulnerabilities, in-context explanations of cookies and headers in Repeater, AI-generated login sequences,...
API Exporter is a Burp Suite extension, authored by Cyproxio at version 1.0 and last updated 13 June 2025, that generates API documentation in OpenAPI 3.1 and Postman 2.1 formats. It extracts request and response details from intercepted HTTP traffic and...
PortSwigger released Burp Suite Professional and Community 2025.5.4 as a stable build on Monday, 16 June 2025 at 14:20 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release updates Burp's...
PortSwigger released Burp Suite Professional and Community 2025.6.1 as an Early Adopter build on Tuesday, 17 June 2025. The release updates Burp's code signing certificate, which had expired and had sometimes caused Windows to show an Unrecognized app...
PortSwigger released Burp Suite DAST 2025.5.2 as a stable version on Wednesday, 18 June 2025 at 10:57 UTC, distributed as a Helm chart, Linux installer (x64), Scanner and Server component updaters, and Windows installer (x64). The release notes state that...
PortSwigger's BApp Store lists a third-party Burp extension, version 1.0.0 by author Dotwut and last updated 26 June 2025, that generates AWS-signed curl commands from HTTP requests. The extension adds valid AWS Signature Version 4 headers so AWS API...
PortSwigger released Burp Suite Professional and Community 2025.5.5 as a stable build on Thursday, 26 June 2025 at 12:10 UTC, available for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release improves the...
PortSwigger released Burp Suite Professional and Community 2025.6.2 as an Early Adopter build on Thursday, 26 June 2025 at 12:10 UTC. The release improves the reliability of the Bambda editor on Windows, reducing system failures during startup. What's...
PortSwigger released Burp Suite Professional and Community 2025.5.6 as a stable build on Monday, 30 June 2025 at 14:32 UTC. The release upgrades Burp's embedded browser to Chromium 138.0.7204.50 on Windows and Mac and 138.0.7204.49 on Linux. What's...
PortSwigger released Burp Suite Professional and Community 2025.6.3 as an Early Adopter build on Monday, 30 June 2025 at 14:47 UTC. The release upgrades Burp's embedded browser to Chromium 138.0.7204.50 on Windows and Mac and 138.0.7204.49 on Linux, with...
PortSwigger Research is returning to Black Hat USA and DEF CON 33 with talks arguing that request smuggling is an inherent flaw in the HTTP/1.1 protocol itself, six years after the firm first brought the issue to mainstream attention. Director of Research...
PortSwigger's BApp Store lists UnUnicode, a Burp Suite extension by godfuzz3r, version 1.3.0, last updated 08 July 2025, that unescapes Unicode-escaped sequences in HTTP requests and responses and in WebSocket messages. The extension is intended to reveal...
PortSwigger's BApp Store lists a Burp Suite extension called JDSer, version 0.9.1, that deserializes Java objects and encodes them in XML using the XStream library, rewritten from scratch to work with the Montoya API. Users load the JAR files containing...
PortSwigger released Repeater Strike, an AI-powered Burp extension by Gareth Heyes that analyzes Repeater requests to find IDOR and other vulnerabilities by automatically generating targeted regular expressions from the requests and responses under test....
PortSwigger researcher Gareth Heyes released Repeater Strike, an experimental AI-powered Burp Suite extension that analyzes Repeater traffic to generate regular expressions and then applies them across proxy history to find IDOR and similar...
PortSwigger released Burp Suite Professional/Community 2025.6.4 on 17 July 2025, adding custom actions that automate message modifications in Burp Repeater, a toggle for switching between single-row and multi-row tab views, and a built-in panel builder for...
PortSwigger released Burp Suite Professional/Community 2025.7 on 17 July 2025, adding wider color choices and automatic next-available coloring for Repeater tab groups, plus form detection that adds HTML forms to the site map and generates a representative...
PortSwigger released Burp Suite Professional and Community 2025.6.5 as a stable build on Monday, 21 July 2025 at 14:54 UTC. The release upgrades Burp's embedded browser to version 138.0.7204.158 on Windows and Mac and 138.7204.157 on Linux, with downloads...
PortSwigger released Burp Suite Professional and Community 2025.7.1 as an Early Adopter build on Monday, 21 July 2025 at 14:55 UTC. The release upgrades Burp's embedded browser to version 138.0.7204.158 on Windows and Mac and 138.7204.157 on Linux, with...
A Burp Suite extension called Log Requests to SQLite, authored by Redguard and Dominique Righetto and updated 24 July 2025 at version 2.0.1, logs HTTP requests and responses to a local SQLite database for later inspection or offline analysis. PortSwigger...
Passkey Raider is a Burp Suite extension, authored by Peeranat Thantaletong of Siam Thanat Hack and listed at version 1.0.2 with a last update of 28 July 2025, built to support comprehensive testing of Passkey systems. It has two components - a Settings...
Contrast Security published Burptrast, a Burp Suite extension version 1.5.0 that integrates Burp with Contrast Security's Teamserver (Assess), letting users import application metadata, endpoints, and vulnerability details into their Burp testing workflow....
PortSwigger's BApp Store lists a Burp Suite extension called PDF Render, version 1.0.0, by author Harel Levy, last updated 30 July 2025. The extension displays PDF documents found in HTTP responses in a dedicated tab inside Burp Suite, so testers can...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Report Generator, version 1.0.0, authored by GHULI3V and last updated 31 July 2025, which lets penetration testers produce vulnerability reports in PDF and Word formats. PortSwigger...
PortSwigger's BApp Store lists a third-party Burp Suite extension, Twilio OTP Authenticator version 1.0.1 by Ganesh Babu, last updated 01 August 2025. The extension integrates with session handling rules to automatically insert a Twilio-generated one-time...
PortSwigger released a Burp extension called Document My Pentest that generates a written description of whatever a tester is probing for, including path traversal, SQL injection, and XSS, and can document items from Proxy History as separate requests or...
In a PortSwigger video, NahamSec and PortSwigger Director of Research James Kettle explain HTTP request smuggling, a class of vulnerabilities still affecting web stacks nearly two decades after it first surfaced. Kettle describes how differences in how...
PortSwigger Research lists WebSocket Turbo Intruder, a Burp extension by Zakhar Fedotkin and Hannah L, at version 2.0.0, last updated 06 August 2025. The extension enables advanced fuzzing of WebSocket messages using custom Python code, with two integrated...
PortSwigger researcher James Kettle published a paper arguing HTTP/1.1 has a fatal flaw in how request boundaries are delimited, enabling new classes of HTTP desync attacks that subverted core infrastructure at Akamai, Cloudflare, and Netlify. One...
PortSwigger Research states that HTTP request smuggling has been a widely known issue since 2019, yet most DAST tools rely on pre-canned payloads aimed at simple CL.TE or TE.CL vectors or merely fingerprint specific CVEs. The article says Burp Suite DAST,...