If you're confused by the amount of resources stored in the JAR, here's a hint 🔎 Check out "resources/Scanner/jwt_secrets.txt". It contains over 100k passwords used by the passive scanner to decrypt JWT tokens 🗝️ And it works: that's how @evilpacket.net scored a $1500 bug affecting Cursor 💰

In case you missed it, AWS updated its policy about pentesting, and "Amazon API Gateway" (used by the extension "IP Rotate") isn't allowed anymore aws.amazon.com/fr/security/...

Hackvertor v2.1.25 has been released and fixes the content-length problem!

Hackvertor v2.1.24 has a major bug where it doesn't update the content-length. Sorry about that. I've fixed it in v2.1.25. I'll try and get it updated on the BApp store ASAP. Gutted I missed this, sorry I'll try to do better in future.

This one-liner shows the details of the most recent EA release of Burp Suite Pro 🔬 curl -s portswigger.net/burp/release... | jq -r '[.ResultSet.Results[] | select(.releaseChannels[0] == "Early Adopter")][:2] | .[] | "=== Version EA v\(.version), \(.releaseDate) ===", "\(.content)"' | html2text

Dive into WebSocket Turbo Intruder 2.0 - fuzz at scale, automate complex multi-step attacks, and exploit faster. The blog post is live! Read it here: portswigger.net/research/web...

TIL Peter Weiner is on Linkedin 👀 www.linkedin.com/in/peter-wei... Did I send him an invitation? OF COURSE!! Has he accepted it? Not yet, but fingers crossed.

You never know when an obscure piece of trivia about Java regular expressions may be useful IRL 🤓 Today, I used the embedded flag "(?-s)" to disable the DOTALL mode and be able to work one a single line 🔬 The goal was to append a string to the User-Agent header, and it now works perfectly 🎉

We use @jameskettle.com Burp extension Collaborator Everywhere daily. Now our upgrades are in v2: customizable payloads, storage, visibility. Perfect for OOB bugs like SSRF. Find out more here: blog.compass-security.com/2025/09/coll... #AppSec #BurpSuite #Pentesting

It feels good to open Burp Suite after some month-long holidays All the bugs I reported have been patched, including the one where Repeater for Websocket wasn't showing the correspoding "response" in the bottom-right corner

It feels good to open Burp Suite after some month-long holidays All the bugs I reported have been patched, including the one where Repeater for Websocket wasn't showing the correspoding "response" in the bottom-right corner

A deep dive into Burp AI, by @parsiya.bsky.social 💎 parsiya.net/blog/2025-08...

I just published a Repeater feature to make it easier to explore request smuggling. It repeats your request until the status code changes. It's called "Retry until success" and you can install it via the Extensibility helper bapp.

Burp Suite v1.0 was released exactly 20 years ago 🎂 portswigger.net/blog/burp-th...

Burp Suite v1.0 was released exactly 20 years ago 🎂 portswigger.net/blog/burp-th...

A deep dive into Burp AI, by @parsiya.bsky.social 💎 parsiya.net/blog/2025-08...

On Day 3 of @why2025.bsky.social (aka Sunday) at 5:00 PM, I'll give a 15-minute talk titled "Python3-based editors in Burp Suite" at the Cyber_Saiyan village. wiki.why2025.org/Village:Cybe... And if you're not interested in Burp Suite, we could nonetheless meet at the arcade room 🎮🕹️🙃

I just added the 15-minute talk I gave at Tumpicon to the "Freebies" section. This talk covers the extensions Piper and Scalpel, and allows users to easily manipulate encrypted data by shuffling blocks around hackademy.agarri.fr/freebies

I just added the 15-minute talk I gave at Tumpicon to the "Freebies" section. This talk covers the extensions Piper and Scalpel, and allows users to easily manipulate encrypted data by shuffling blocks around hackademy.agarri.fr/freebies

You're not ready for how powerful Custom Actions are. You can now build your own AI hacking sidekicks that rewrite requests for you. Forget typing payloads - just let your assistant do it. 🔥 Welcome to the future of offensive automation. Get the source code: github.com/PortSwigger/...

We've just released a massive update to Collaborator Everywhere! This is a complete rewrite by @compass-security.com which adds loads of features including in-tool payload customization. Massive thanks to Compass for this epic project takeover. Check out the new features:

Concerned about LLM-powered pentesters stealing your job? We've made improving your workflow with AI easier than ever - you can now build your own AI features directly inside Repeater with Custom Actions. Here's one I built for myself:

Piper is an excellent swiss knife 🛠️ bsky.app/profile/agar...

If you're confused by the amount of resources stored in the JAR, here's a hint 🔎 Check out "resources/Scanner/jwt_secrets.txt". It contains over 100k passwords used by the passive scanner to decrypt JWT tokens 🗝️ And it works: that's how @evilpacket.net scored a $1500 bug affecting Cursor 💰

Never opened the Burp Pro JAR file as a ZIP archive? You should give it a try...

The Scalpel extension is magic 🪄 Especially if you're a big fan of executing both python3 and vim within Burp Suite 🛠️ blog.lexfo.fr/scalpel.html

The Scalpel extension is magic 🪄 Especially if you're a big fan of executing both python3 and vim within Burp Suite 🛠️ blog.lexfo.fr/scalpel.html

Opened 7 tickets with Portswigger support in one week. Sometimes I wonder if they hate me... 🤔

If you never used the Piper extension, I recommend to watch the 4-minute demo I gave last year during my talk at NorthSec 🛠️

Active Scan++ just got sharper - we’ve added new checks for OS command injection, powered by our latest ASCII Control Characters research. Install via Extensions -> BApp Store

A small win: since EA 2025.5, Repeater's "Change body encoding" feature also supports JSON 🥳

TIL in the latest Early Adopter version (aka 2025.5), extensions don't need to manage their own settings panel anymore, as they can simply add entries to "Settings > Tools > Extensions" 🤯 And to be honest, I find that awesome! 💎

In case you've a hard time intercepting Firefox traffic to the loopback interface, open the about:config page and set "network.proxy.allow_hijacking_localhost" to True 🎁 Thanks @onemask.bsky.social for the tip 🙏

TIL in the latest Early Adopter version (aka 2025.5), extensions don't need to manage their own settings panel anymore, as they can simply add entries to "Settings > Tools > Extensions" 🤯 And to be honest, I find that awesome! 💎

In case you've a hard time intercepting Firefox traffic to the loopback interface, open the about:config page and set "network.proxy.allow_hijacking_localhost" to True 🎁 Thanks @onemask.bsky.social for the tip 🙏

A nice bug affecting Cursor and identified by @burpsuite.bsky.social passive scanner 😈

A nice bug affecting Cursor and identified by @burpsuite.bsky.social passive scanner 😈

When the same HTTP request gets you 3 different response code, you known something is weird... And thanks @jameskettle.com for the race condition custom action, it's really convenient to have it directly in Repeater.

Portswigger published a detailed guide on how to write a Custom Action (which is a bambda executed in Repeater) portswigger.net/burp/documen...

A post by @dustri.org about making Burp Suite faster on Asahi Linux dustri.org/b/making-bur...

The custom actions I wrote myself have been added to the official repository github.com/PortSwigger/...

Portswigger published a detailed guide on how to write a Custom Action (which is a bambda executed in Repeater) portswigger.net/burp/documen...

I just built a custom action to let you test for race conditions with a single click! No tab groups required, and it uses the cutting edge single-packet attack under the hood: gist.github.com/albinowax/10... For more info check out portswigger.net/research/sma...

I tried to use Burp Suite's embedded browser under Ubuntu 24.04, and like for everybody else, it didn't work... 💔 I looked for advice online and noticed some recommendations to make the chrome binary suid-root. Don't do that! 🚫 Instead, create a AppArmor profile for this binary and voilà! ❤️‍🩹

I tried to use Burp Suite's embedded browser under Ubuntu 24.04, and like for everybody else, it didn't work... 💔 I looked for advice online and noticed some recommendations to make the chrome binary suid-root. Don't do that! 🚫 Instead, create a AppArmor profile for this binary and voilà! ❤️‍🩹

Some details about the only on-site training session I'll be giving in 2025 - early-bird price is valid up to June 1st (10% off) 💰 - 4 seats out of 20 are already gone ⏳

If you use the Burp extension "Piper", I strongly recommend to watch the video below, published by its author @silentsignal.bsky.social a few years ago. It explains the logic behind it and some of its design choices 💎 www.youtube.com/watch?v=xrQo...

If you also missed the new button like me, quickly see your Burp AI credits in the Burp UI at the bottom right: