This release adds some powerful new Scanner checks based on James Kettle 's talk at Black Hat today. For full details of this awesome new research, see our blog post on practical web cache poisoning.

What is DAST security testing? Dynamic application security testing (DAST) tests security from the outside of a web app. A good analogy would be testing the security of a bank vault by attacking it.

Browser-powered scanning enables you to test modern websites comprehensively. For example, some websites have a dynamically generated UI that is not present in raw HTML. A regular crawler engine would ...

Details enables you to specify the actions that the rule performs when it is applied to a request. Scope enables you to specify the tools, URLs and parameters that the rule applies to. Access the Rule ...

Burp Scanner is capable of detecting a wide range of vulnerabilities, which are flagged by the scanner as issues. This table lists all vulnerabilities that can be identified by Burp Scanner. It is ...

This documentation describes the functionality of all editions of Burp Suite and related components. Use the links below to get started: ...

If you need to use an external browser with Burp instead of Burp's preconfigured Chromium browser, perform the following configuration steps. For the vast majority of users, this process is not ...

When you launch a Burp Intruder attack, the attack runs in a new results window. This contains the attack results, and a clone of the configuration side panel from which the current attack is based.

You need to configure Firefox so that you can use it for testing with Burp Suite.

This lab uses a JWT-based mechanism for handling sessions. The server supports the jwk parameter in the JWT header. This is sometimes used to embed the correct verification key directly in the token.

SQL injection vulnerabilities occur when an attacker can interfere with the queries that an application makes to its database. You can use Burp to test for these vulnerabilities: Professional Use Burp ...

This page answers common questions about how Burp AT and Burp AI keep your testing safe, how you stay in control when using AI features, and how PortSwigger handles the data you send. Both Burp AT and ...