Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Burp On Tour 2025 traveled across continents to university campuses, grassroots meetups, and major security conferences to connect with students, hobbyists, practitioners, and researchers. At Black Hat USA in August, PortSwigger Director of...
PortSwigger's BApp Store lists HTTP Batch Tool, a Burp Suite extension by Emanuel Caique at version 1.1.0, last updated 15 December 2025, that processes bulk HTTP requests by letting users paste multiple URLs and send them concurrently. It adds a dedicated...
PortSwigger released Burp Suite Professional and Community 2025.12.1 as an Early Adopter build on Tuesday, 16 December 2025 at 09:41 UTC. The release upgrades Burp's embedded browser to Chromium 143.0.7499.110 for Windows and Mac and 143.0.7499.109 for...
PortSwigger released Burp Suite Professional and Community 2025.11.5 as a stable build on Tuesday, 16 December 2025 at 09:43 UTC. The release upgrades Burp's embedded browser to Chromium 143.0.7499.110 on Windows and Mac and 143.0.7499.109 on...
PortSwigger released a Burp Suite update on 16 December 2025 that adds scan freeze windows for automatically pausing and resuming scans, and lets users edit individual steps in a recorded login sequence instead of re-recording the whole flow. The release...
PortSwigger's BApp Store lists Session Keeper, a Burp Suite extension by Joe Black Security, version 1.0.0, last updated 18 December 2025, that automatically resends low-impact requests at configurable intervals to keep active sessions alive. The listing...
Galaxy (MITM Decryption) is a Burp Suite extension, version 3.3.7 by author outlaws-bai and last updated 18 December 2025, that automatically decrypts encrypted HTTP traffic in real-time so applications with encrypted communications can be tested as if...
PortSwigger released Burp Suite Professional and Community 2025.11.6 as a stable build on Friday, 19 December 2025 at 11:35 UTC. The release upgrades Burp's embedded browser to Chromium 143.0.7499.147 on Windows and Mac and 143.0.7499.146 on Linux. What's...
PortSwigger released Burp Suite Professional and Community 2025.12.2 as an Early Adopter build on Friday, 19 December 2025, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release upgrades Burp's...
PortSwigger Research opened nominations for its annual Top 10 web hacking techniques list, a community project running since 2006 that collects reusable attack techniques from the year's blog posts, presentations, and whitepapers. The call asks for a URL...
PortSwigger's BApp Store lists a Burp extension called GAP (Get All Parameters, Links, and Words), version 6.2.0, by author XNL-h4ck3r, last updated 07 January 2026. The extension collects all parameter names observed during scanning or manual testing into...
PortSwigger's BApp Store lists DNS Exfilnspector, a Burp Suite extension by author LazyTitan, version 1.3.0, last updated 07 January 2026. The extension monitors Burp Collaborator interactions and automatically decodes DNS exfiltration queries in real...
PortSwigger lists a Burp extension called Proxy Rotate, version 1.0.1 by Petru Surugiu, that routes each HTTP request through a different proxy from a configurable list, assigning a proxy per connection. The listing states this enables IP rotation for...
Piper is a Burp Suite extension, authored by Andras Veres-Szentkiralyi at version 0.8, that passes HTTP requests and responses to external command-line programs through configurable pipelines and feeds the results back into Burp. PortSwigger notes that the...
PortSwigger released a Burp Suite extension called Trusted Domain CORS Scanner, version 1.1.0 by Thomas Stacey, that adds scan checks for permissive CORS issues including URL validation bypasses drawn from PortSwigger's bypass cheat sheet and Corben Leo's...
PortSwigger released Burp Suite Professional and Community 2025.12.3 on 15 January 2026, adding collections that let Pro users share HTTP messages via an encrypted Burp link that PortSwigger says it cannot see. The release also adds OAuth2 Client...
Pentester Julen Garrido Estévez tested Burp AI in Repeater against PortSwigger Web Security Academy labs, the deliberately vulnerable ginandjuice.shop, and his own environments, logging each interaction as a reproducible test case covering time to PoC,...
PortSwigger released Burp Suite Professional and Community 2026.1 on 16 January 2026, replacing the Learn tab with a Discover tab and adding command palette navigation for jumping to specific locations in most tables. The release also adds Burp Scanner...
PortSwigger's BApp Store lists a Burp extension called DPoP Authenticator, authored by Serhat Cicek at version 1.0, that dynamically adds or updates the DPoP (Demonstrating Proof of Possession) HTTP header on outgoing requests based on configured criteria....
PortSwigger released Burp Suite Professional and Community Edition 2025.12.4 as a stable build on Tuesday, 20 January 2026 at 09:49 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release...
PyCript is a Burp Suite extension, version 2.0, that encrypts and decrypts requests, responses, and WebSocket messages for manual and automated application penetration testing. It lets testers write custom encryption and decryption logic in any language,...
PortSwigger lists a Burp extension called Response Overview, version 1.6.0, authored by Tobias "floyd" Ospelt, that groups HTTP response bodies by similarity and presents one request/response per group. The extension is intended to help security testers...
PortSwigger's BApp Store lists API Workflow Manager, a Burp extension by Omkar Yepre at version 1.0.1, last updated 22 January 2026, that centralizes API endpoint management during security testing. It collects, categorizes, and exports HTTP requests with...
IT security consultant Adarsh Kumar describes using Burp AI inside Repeater during a time-boxed test of a multi-tenant SaaS platform with a REST API and token-based authentication, asking it to suggest access control tests for GET /api/orders/{orderId}....
PortSwigger's BApp Store lists a Burp Suite extension, version 1.0.1 by Richard Turnbull of NCC Group, that adds Kerberos authentication support for testing in a Windows domain where NTLM authentication is not supported. The extension does not require the...
PortSwigger's BApp Store lists BubblePop, a Burp Suite extension by samanL33T at version 2.1.0, that automatically decrypts and re-encrypts the encrypted Elasticsearch payload data used by Bubble.io applications. The extension is intended to let security...
PortSwigger's BApp Store lists a GraphQL Security Tester extension, version 1.0.0, by Nayan Goel and Nandan Gupta, last updated 04 February 2026. The extension generates malicious GraphQL test queries for authorized security testing, with automatic and...
PortSwigger Research published its 19th annual Top 10 Web Hacking Techniques of 2025, drawn from 63 community nominations reviewed by a panel including Nicolas Grégoire, Soroush Dalili, STÖK, Fabian (LiveOverflow) and James Kettle. The top spot went to...
PortSwigger's BApp Store lists Auraditor, a Burp Suite extension by Soroush Dalili for security testing of Salesforce Lightning and Aura framework applications, at version 2.0.2 with a last-updated date of 10 February 2026. The extension provides action...
Levo Inc. released version 0.2.1 of a Burp Suite extension that builds OpenAPI specs from Burp's traffic using Levo.ai, and detects and classifies PII to annotate those specs. By default specs are built for all traffic and traffic is not sent to Levo's...