@BurpSuiteGuide

Your guide to all things Burp Suite! Subscribe to my newsletter: https://xitter.cf/t.co/Nxtewg5M1x

burpsuite.guide
Joined December 2020
  • Tweets382
  • Following22
  • Followers3.4K
28Media
What's happening in the Burp-verse - Issue #13 📰 is out! #burpsuite #newsletter newsletter.burpsuite.guide/a…
2
BurpSuite.guide retweeted
BApp Store@BApp_Store24 Nov 2022
Updated: Active Scan++ portswigger.net/bappstore/31…

Active Scan++

Extends Burp's active and passive scanning capabilities.

portswigger.net
4
9
BurpSuite.guide retweeted
BApp Store@BApp_Store24 Nov 2022
Updated: Nuclei Burp Integration portswigger.net/bappstore/9c…

Nuclei Burp Integration

Allows you to run Nuclei Scanner directly from Burp and transforms JSON results into the issues.

portswigger.net
5
16
BurpSuite.guide retweeted
Burp Suite
@Burp_Suite28 Oct 2022
Introducing the brand new flavour of Burp Suite - completely free, and available for a CI/CD pipeline near you … #cicd #dast portswigger.net/blog/free-da…

Free: Dastardly from Burp Suite

Introducing Dastardly - a free, lightweight web application security scanner for your CI/CD pipeline, from the makers of Burp Suite. Secure web development ain't easy Ensuring your code is written sec

portswigger.net
11
105
9
358
HTTP/3 connection contamination: an upcoming threat - by @albinowax portswigger.net/research/htt…

HTTP/3 connection contamination: an upcoming threat?

I recently documented a dangerous reverse-proxy behaviour called first-request routing, which enables host-header attacks on back-end systems. In this post, I'll show how first-request routing also en

portswigger.net
1
87
3
257
BurpSuite.guide retweeted
Silent Signal@SilentSignalHU19 Oct 2022
We released a @Burp_Suite extension to scan for CVE-2022-42889, aka. Text4Shell: blog.silentsignal.eu/2022/10…
2
121
3
350
That's what an expert user looks like! 🧠 Intruder + Hackvertor + Stepper, by @irsdl github.com/CoreyD97/Stepper/…
10
58
BurpSuite.guide retweeted
Burp Suite
@Burp_Suite16 Sep 2022
Burp Suite 2022.9.1 released to the Early Adopter channel. Includes an upgrade to Burp's browser and various bug fixes. portswigger.net/burp/release…

Professional / Community 2022.9.1

This release provides an upgrade for Burp's browser and some bug fixes. Browser upgrade We have upgraded Burp's browser to Chromium 105.0.5195.125, which patches a number of high-severity security iss

portswigger.net
3
18
BurpSuite.guide retweeted
James Kettle
@albinowax16 Sep 2022
Last week I published a number of novel CL.0 desync techniques, alongside advice on tuning your research to outwit the competition. Next week, a way to turn a 'medium' severity flaw into a crit with a $12k case study. And no it's not XSS :) portswigger.net/research/how…
6
40
169
BurpSuite.guide retweeted
James Kettle
@albinowax13 Aug 2022
Hope you enjoyed the talk, thanks for coming! Always a pleasure to present to a @defcon crowd. Time for a couple drinks, then on to the next research for me. You can find the sides&whitepaper here: portswigger.net/research/bro…

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

The recent rise of HTTP Request Smuggling has seen a flood of critical findings enabling near-complete compromise of numerous major websites. However, the threat has been confined to attacker-accessib

portswigger.net
7
65
3
242
Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling by @albinowax portswigger.net/research/bro…

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

The recent rise of HTTP Request Smuggling has seen a flood of critical findings enabling near-complete compromise of numerous major websites. However, the threat has been confined to attacker-accessib

portswigger.net
9
179
7
463
BurpSuite.guide retweeted
Burp Suite
@Burp_Suite10 Aug 2022
Burp Suite 2022.8.1 released to the Stable channel, with new scan checks based on the Browser-Powered Desync Attacks presented by @albinowax at Black Hat 2022, as well as new Repeater capabilities that let you test for these vulnerabilities manually. portswigger.net/burp/release…

Professional / Community 2022.8.1

This release provides new scan checks based on James Kettle's Browser-Powered Desync Attacks, first presented at Black Hat USA 2022. It also introduces the new capabilities for Burp Repeater that enab

portswigger.net
28
1
66
We've prototyped a new feature in repeater where we are diffing the last response with the current and showing different colours depending on what changes. Please check it out we'd love your feedback! portswigger.net/bappstore/90…
21
79
8
544
BurpSuite.guide retweeted
PortSwigger
@PortSwigger4 Aug 2022
This is a Burp extension, and it's only a prototype currently - check it out and feel free to share your thoughts with us!
PortSwigger Research@PortSwiggerRes3 Aug 2022
We've prototyped a new feature in repeater where we are diffing the last response with the current and showing different colours depending on what changes. Please check it out we'd love your feedback! portswigger.net/bappstore/90…
1
13
1
114
BurpSuite.guide retweeted
Burp Suite
@Burp_Suite22 Jul 2022
Burp Suite 2022.7.1 released to the Stable channel. You can now configure tab-specific options for Repeater and automatically detect client-side prototype pollution sources using Burp Scanner. portswigger.net/burp/release…

Professional / Community 2022.7.1

This release introduces tab-specific options in Repeater and client-side prototype pollution reporting in Burp Scanner. It also provides a change to the way Burp's browser handles the User-Agent heade

portswigger.net
1
11
1
62
It's worth knowing @Burp_Suite project files are memory mapped. This means they reduce RAM consumption, but don't support garbage collection (yet) so deleting requests frees up RAM for Burp, but doesn't reduce file size. For long-term storage, use 'Project->Save copy' then zip.
2
19
3
67
Framing without iframes by @garethheyes portswigger.net/research/fra…

Framing without iframes

Whilst testing for XSS vectors, we found some new ways of framing a web site that don't use the iframe element. Naturally, we've updated our XSS cheat sheet to document them. We discovered that Chrome

portswigger.net
3
59
2
178
BurpSuite.guide retweeted
Hack Red Con@HackRedCon19 Jul 2022
For this week's "There's a BApp for that", @Nu11ifidian shows how to use Stepper, a natural evolution of Burp Suite's Repeater tool to help automate “second-order” attacks. hackredcon.com/post/there-s-… #burpsuite #pentester #cybersecurity #infosec #cybersecuritytips #HackRedCon
3
4
1
How we tune @Burp_Suite's performance: - "Proxy->Options->Misc->Don't send items to Proxy history or live tasks, if out of scope" - Enable "Project Options->HTTP->{keep-alive,HTTP/2}" - Disable live-tasks & extensions
9
130
4
455
BurpSuite.guide retweeted
Hack Red Con@HackRedCon5 Jul 2022
Hey, Folks! Check this weekly series with Zachary Stashis called "There's a BApp for that". It shows a technical how-to-use of certain Burp Suite Plugins to help with Penetration Testing and Bug hunting. hackredcon.com/there-s-a-bap… #cybersecurity #pentesting #HackRedCon
3
4
BurpSuite.guide retweeted
Soroush Dalili
@irsdl17 Jul 2022
#BurpSuite Sharpener extension has been updated to version 1.9 to remember last size & position of Burp Suite as well as detecting whether it is off-screen! It also includes a number of important bug fixes: github.com/mdsecresearch/Bur… Hopefully @BApp_Store will update it soon too.

GitHub - mdsecresearch/BurpSuiteSharpener

Contribute to mdsecresearch/BurpSuiteSharpener development by creating an account on GitHub.

github.com
15
44
Load more