Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
HaE is a Burp Suite extension, authored by gh0stkey and listed at version 5.3.1, that uses multi-engine customized regular expressions to tag and extract information from HTTP messages, including WebSocket traffic. It loads an offline rule database from...
CSTC is a Burp Suite extension, authored by usdAG and listed at version 1.3.7 with a last update of 23 July 2026, that brings CyberChef-like transformation capabilities into Burp so users can define custom recipes that automatically transform outgoing and...
PortSwigger launched Burp AT in public beta for Burp Suite Professional users, letting agentic AI pursue testing tasks inside Burp using its specialist tools, project context, and pentesting skills developed with PortSwigger Research, while the tester...
Sharpener is a third-party Burp Suite extension by Soroush Dalili, at version 4.92 and last updated 28 July 2026, that adds UI and functional features to Burp, including configurable keyboard shortcuts that work anywhere in the tool. Shortcuts must use...
PortSwigger released Burp Suite Professional and Community 2026.7.2 as a stable build on Thursday, 30 July 2026 at 13:24 UTC. The release fixes an issue where scans initiated via Burp AT would fail to resume after Burp was restarted, and upgrades Burp's...
PortSwigger lists Logic Mapper, a Burp Suite extension by Joel Indra at version 1.0.0, as a tool that represents HTTP requests as nodes on an interactive canvas so testers can map request sequences, annotate steps, and trace multi-stage workflows during...
PortSwigger launched Burp AT in public beta for Burp Suite Professional users, a product built around agentic AI that can generate and test hypotheses and pursue lines of investigation using Burp's tooling. In Burp AT, agents decide what to try, but...
PortSwigger lists a BApp Store extension, AI Bambda Generator, that takes a plain-English description of a desired Bambda and generates a complete Java implementation ready to paste into the Burp editor. The extension tailors output to the selected Bambda...
During a four-plus-one pentest engagement, security analyst Ray Huygen used Burp AT to analyze a 66,000-line minified JavaScript bundle that he could not justify reviewing manually, and the tool found that whistleblower reports were protected only by a...
PortSwigger released version 3.0 of its HTTP Request Smuggler extension in 2025, adding parser discrepancy detection that the vendor says bypasses widespread desync defences. The extension detects and exploits HTTP Request Smuggling using desynchronization...
Param Miner is a Burp Suite extension by James Kettle of PortSwigger that identifies hidden, unlinked parameters, using diffing logic from Backslash Powered Scanner and a binary search technique to guess up to 65,536 parameter names per request. Names come...
PortSwigger researcher James Kettle built an autonomous system called the HTTP Terminator that generated 30,000 unique desync vectors from 15,000 micro-fragments of 138 HTTP and SMTP RFCs, and used them to compromise banks, security solutions, and...
PortSwigger released a Burp extension called CRLF-Powered Desync Scanner, version 1.0.0, authored by Tom Stacey, which detects HTTP request and response header injection vulnerabilities that arise when a front-end proxy forwards CRLF sequences into the...
PortSwigger researchers documented turning HTTP header injection into CRLF-powered desync attacks, including response queue poisoning that let them capture session cookies and auth tokens for thousands of applications hosted on a CDN. Case studies included...
PortSwigger released Burp Suite Professional and Community 2026.7.3 as a stable build on Thursday, 6 August 2026 at 13:32 UTC, with desktop JAR installers for Linux, macOS and Windows in ARM and x64 variants. The release fixes an issue where Burp AT could...
PortSwigger researcher Gareth Heyes found that webmail clients including Yahoo Mail, AOL Mail, Fastmail, ProtonMail, Gmail and Outlook render untrusted CSS in a trusted UI, and that sanitizer-versus-browser parsing discrepancies let him spoof UI actions,...
PortSwigger's James Kettle built an autonomous system called the HTTP Terminator that read 138 technical specifications, broke them into 15,000 fragments, generated 30,000 unique attack vectors, and tested them against live bug bounty targets, confirming...
PwnFox For Chromium is a PortSwigger BApp Store extension, version 1.3.4, that brings the core features of the original PwnFox extension into Chromium-based browsers for multi-session web security testing. It connects Chromium with Burp Suite to provide...
Pentest-Tools.com released a Burp Suite extension, version 1.0.1, that lets penetration testers send audit issues from Burp directly to their Pentest-Tools.com workspaces with a right-click. The extension is intended to let testers triage findings and keep...
PortSwigger's BApp Store lists a third-party Burp Suite extension called Reverse Shell Receiver, version 1.0.0, by author joelindra, last updated 13 August 2026. The extension gives penetration testers a single tab combining an HTTP webhook listener for...
PortSwigger released Burp Suite DAST version 2026.8.1 as a stable release on Thursday, 13 August 2026 at 14:51 UTC, available as a Helm chart, Linux installer (x64), scanner and server component updaters, and Windows installer (x64). The release notes...
PortSwigger released Burp Suite Professional/Community 2026.8 on 24 August 2026, adding customizable title bar actions, support for multiple evidence items on manually created issues, and evidence highlighting for issues raised by Burp AT. The release also...
ByteBanter is a custom Burp Suite Intruder payload generator, authored by Andrea Braschi and listed at version 3.1.0, that uses large language models to produce payloads from a natural-language prompt. It uses Burp AI by default and also supports Ollama,...
A Burp Suite extension called HTTP History to PCAP, authored by turekt at version 1.1.0 and last updated 25 August 2026, converts selected HTTP traffic from the Proxy HTTP History tab into PCAP files. The extension generates packet captures with complete...
PortSwigger researcher Gareth Heyes found that a tag's localName property returns a lowercase version of the tag name, letting JavaScript be written into tag names and executed, and that the technique works in every browser. He fuzzed tag name...
PortSwigger released Burp Suite DAST 2026.8.2 on 27 August 2026, adding an MCP server that lets AI clients such as Claude Code, Claude Desktop, or Cursor connect to scans and issues using an API key. The release also makes Burp AI generally available for...
SpecOps is a Burp Suite extension, version 1.4.2 by author rawatprince, that ingests an OpenAPI or Swagger specification and builds a workbench for testing every documented endpoint. Specs can be loaded from a file, URL, or pasted directly, and the...
PortSwigger's BApp Store lists JWT Editor, a Burp Suite extension by Dolph Flynn and Fraser Winterborn, version 2.6.2, last updated 07 September 2026, for analyzing and manipulating JSON Web Tokens inside Burp. It provides editing for JWS and JWE tokens,...
Hackvertor is a Burp Suite extension that transforms, encodes, decodes, encrypts, and hashes data using nested XML-like tags such as <@base64>text</@base64>. Its AI features can generate custom tags in JavaScript, Python, Groovy, or Java from a...
PortSwigger released Burp Suite Professional / Community 2026.9 on 21 September 2026, adding the ability to export individual SMTP Collaborator interactions as .eml files that include the email content and relevant Collaborator metadata. The release also...