Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger released Burp Suite Professional / Community 2025.9.1 on Friday, 12 September 2025 at 13:58 UTC, fixing a startup bug and upgrading Burp's browser to address a critical CVE. The release fixes a bug where Burp failed to start correctly if the...
PortSwigger researcher @zakfedotkin published WebSocket Turbo Intruder, a Burp Suite extension that brings Turbo Intruder's fast attack engine to WebSocket testing, installable from the BApp Store or built from GitHub. The tool adds a THREADED engine for...
PortSwigger's BApp Store lists a Burp Suite extension called JWT Monitor, built by Patrick Schmid of Redguard AG, that watches a supplied JWT token for expiration and swaps any existing JWT tokens in outgoing requests with the monitored one. Version 1.1.1,...
PortSwigger's BApp Store lists HARbringer, a third-party Burp extension by author abirasecurity at version 1.0.0, last updated 18 September 2025, that imports HTTP Archive (HAR) files directly into the site map while preserving the original HTTP requests...
PortSwigger's BApp Store lists Type Xplorer, a Burp Suite extension by Mohammad Khaleghdadi, version 1.0.0, last updated 18 September 2025, that tests different content types in HTTP requests. It lets users try all possible Content-Types such as...
PortSwigger Research's paper 'HTTP/1.1 must die: the desync endgame' reports that James Kettle and a team of bug bounty hunters and researchers compromised 3 major CDNs using 2 new desync vulnerability classes, earning over $350,000 in payouts. Pentester...
PortSwigger released Burp Suite Professional/Community 2025.9.2 on 22 September 2025, fixing several custom scan check bugs and upgrading Burp's embedded browser to Chromium 140.0.7339.186 on Windows and Mac and 140.0.7339.185 on Linux. The fixes cover...
PortSwigger released Burp Suite Professional and Community 2025.8.5, a stable build dated Monday, 22 September 2025 at 13:33 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release upgrades...
PortSwigger's BApp Store lists a third-party Burp extension called WebSocket History Exporter, version 1.0.0, authored by SpinHerder and last updated 23 September 2025. The extension adds a dedicated interface for selecting, configuring, and saving...
PortSwigger lists Linebreaker, a Burp Suite extension by Ads Dawson at version 1.0.0 and last updated 23 September 2025, which renders escaped newline sequences (\n) as actual line breaks in a dedicated message editor tab. The tool is meant to improve...
PortSwigger added agentic Burp AI capabilities to Burp Suite Professional, including direct pairing with Burp AI inside Repeater so testers can prompt it without switching tools. The AI can generate and send payloads to test for stored XSS, attempt filter...
Formatify is a Burp Suite extension by Siddharth Joshi, version 1.4.0 and last updated 25 September 2025, that converts HTTP requests into multiple code formats including JavaScript Fetch, cURL, Python Requests, Go, PowerShell, and specialized security...
PortSwigger released Burp Suite Professional and Community 2025.8.6 on 25 September 2025, improving error messaging for scan failures caused by recorded logins and fixing a bug where floating inputs created duplicate lists on pages with many clickables....
PortSwigger released Burp Suite Professional / Community 2025.9.3 on 25 September 2025, reorganizing the crawl and audit settings for easier navigation and upgrading Burp's browser to Chromium 140.0.7339.208 on Windows and Mac and 140.0.7339.207 on Linux....
PortSwigger's BApp Store lists a Burp Suite extension called CVSS v3.1 Visual Calculator, version 1.0.0, by Harith Dilshan (h4rithd), last updated 30 September 2025. The extension provides an interactive interface for calculating and visualizing CVSS v3.1...
PortSwigger's BApp Store lists TickTockEnum, a Burp Suite extension by scho-d4n at version 1.0.0, last updated 30 September 2025, that identifies vulnerabilities through response time analysis. It detects discrepancies in server response times between...
PortSwigger published a walkthrough in which bug bounty researcher NahamSec demonstrates Burp AI inside Burp Suite Professional, using it in Repeater, Scanner follow-up, and recorded logins to move from a hunch to evidence. PortSwigger states all AI...
PortSwigger released Burp Suite Professional and Community 2025.8.7 as a stable update on Wednesday, 1 October 2025. The release fixes an issue where scans failed with a critical error if a recorded login without a status check failed; scans now continue...
PortSwigger released Burp Suite Professional and Community 2025.9.4 as an Early Adopter build on Wednesday, 1 October 2025 at 15:07 UTC. The release fixes an issue where scans failed with a critical error if a recorded login without a status check failed;...
PortSwigger's BApp Store lists Token Tailor, a Burp Suite extension by author forteBruno at version 1.0.2, which automates renewal of JWT and Basic authentication tokens during scans. The extension applies session management to all traffic passing through...
HackerOne's 2025 Hacker-Powered Security Report found that 70% of surveyed researchers now use AI tools in their workflow, while only 12% believe AI could replace humans entirely. PortSwigger cites the report in positioning its Burp AI feature, built into...
At Black Hat USA 2025 and DEF CON 33, PortSwigger Director of Research James Kettle presented new HTTP desync techniques, and CEO Dafydd Stuttard told security leaders that any HTTP/1.1 hop in a stack should be treated as vulnerable. HTTP/1.1 still carries...
PortSwigger released Burp Suite Professional and Community 2025.8.8 as a stable build on Monday, 13 October 2025 at 14:02 UTC. The release upgrades Burp's embedded browser to Chromium 141.0.7390.66 on Windows and Mac and 141.0.7390.65 on Linux. What's...
PortSwigger released Burp Suite Professional/Community 2025.9.5 on 13 October 2025, adding support for custom Java scan checks written through the Montoya API alongside the existing BChecks language. The release also redesigns the scan launcher's Scan...
PortSwigger released Burp Suite Professional/Community 2025.10 on 17 October 2025, adding smarter HTTP history filtering that hides binary files and static assets by default, a toggle between filtered and full history views, and color-coded HTTP methods...
A Burp Suite extension called Software Vulnerability Scanner, authored by Vulners.com and updated 21 October 2025 at version 1.4.2, scans HTTP responses to fingerprint software and checks detected versions against the Vulners.com vulnerability database. It...
PortSwigger released a video in which Tib3rius tests Burp AI's new agentic capabilities against a vulnerable web app, with the tool autonomously exploiting discovered vulnerabilities and flagging false positives. The agentic mode in Repeater lets users...
CyberMaddy conducted a side-by-side experiment testing Burp AI's agentic capabilities in bug bounty hunting, documenting the exact prompts used to guide the LLM through vulnerability discovery. PortSwigger describes the results as impressive and positions...
PortSwigger released Burp Suite Professional/Community 2025.10.1 on 28 October 2025, adding smarter HTTP history filtering that hides binary files and static assets by default, a toggle between filtered and full history views, and color-coded HTTP methods...
Brida is a Burp Suite extension, version 0.6.0 by Federico Dotta and Piergiovanni Cipolloni, that bridges Burp and Frida so testers can intercept and modify traffic between mobile applications and their backend servers while calling the app's own functions...