The newest Burp Suite resources are on the Burp Suite page. For a reading order instead of a date order, see the Burp Suite learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-09-07 2021 | Authorization Testing: AuthMatrix - Part 1 | White Oak Security intermediate 2 min read | This article is not an application security library and does not describe specific techniques, tools, CVEs, vulnerabilities, or vendors. It appears to be marketing material for an IT and cybersecurity services company. → whiteoaksecurity.com |
| 2021-08-30 2021 | Web App Pentesting With Burp Suite Scan Profiles | White Oak intermediate 2 min read | This article is a summary of a DEF CON 32 talk on hardware fault injection. The talk covered techniques like voltage glitching and clock manipulation to bypass security mechanisms. It also discussed common hardware vulnerabilities found in embedded systems and IoT devices, and presented methods for exploiting them. → whiteoaksecurity.com |
| 2021-08-30 2021 | Web App Pentesting With Burp Suite Scan Profiles intermediate 2 min read | Guide on optimizing Burp Suite scan profiles for effective web application penetration testing, detailing strategies for vulnerability discovery and risk management. → whiteoaksecurity.com |
| 2021-08-25 2021 | Burp Suite for Pentester: Repeater beginner 8 min read | Library for Burp Suite Professional's Repeater, enabling pentesters to modify and resend HTTP requests to analyze server responses. Features include tab renaming, changing request methods (GET, POST, etc.), navigating request history, pasting URLs directly as requests, automatic URL encoding for easier parameter handling, configurable redirection following, and search functionality within requests and responses for efficient analysis of web application behavior. |
| 2021-08-21 2021 | Why u should use burp to test Path Traversal Vulnerability and also get RXSS intermediate XSS | Why u should use burp to test Path Traversal Vulnerability and also get RXSS |
| 2021-07-25 2021 | burpa: Burp Automator intermediate 5 min read | Library for automating Burp Suite scans, burpa offers a high-level CLI and Python interfaces to launch Dynamic Application Security Testing (DAST) scans. It utilizes the official REST API for scan execution and report generation, supporting authenticated scans with application credentials. Configuration can be managed via environment variables or `.env` files. Burpa provides commands for scanning URLs, generating reports, scheduling scans, stopping Burp Suite, and testing API connectivity. |
| 2021-07-19 2021 | Top 11 extensions to turn your browser into an advance hacking tool intermediate Bug Bounty | This content lists eleven browser extensions designed to transform a web browser into an advanced hacking tool. The article aims to equip users with resources for penetration testing and security analysis directly within their browser environment. The extensions likely offer functionalities for tasks such as network scanning, vulnerability assessment, and code inspection. |
| 2021-07-19 2021 | Leveraging Burp Suite extension for finding IDOR(Insecure Direct Object Reference). intermediate IDOR | This content focuses on using a Burp Suite extension to discover Insecure Direct Object References (IDOR) vulnerabilities. IDORs occur when an application allows users to access resources they are not authorized to by manipulating parameters like IDs. The Burp Suite extension likely automates or assists in identifying these flaws within web applications, making security testing more efficient. |
| 2021-07-14 2021 | RequestBin Collect inspect and debug HTTP requests and webhooks beginner 1 min read API Sec | Tool for inspecting and debugging HTTP requests and webhooks. This platform, reliable since 2018 and SOC 2 compliant, offers cloud storage for persistent data access across devices, enabling real-time request monitoring, detailed analytics, and collaborative debugging for distributed teams, with free and upgrade options available. |
| 2021-06-30 2021 | Introducing DOM Invader: DOM XSS just got a whole lot easier to find beginner 7 min read XSS | Library for finding DOM-based XSS vulnerabilities in web applications. DOM Invader, a Burp Suite extension, simplifies DOM XSS discovery through its Augmented DOM feature, presenting a tree view of sources and sinks. It aids in identifying issues by highlighting user input within sinks and supports testing for web-message vulnerabilities, including spoofing origins and generating proof-of-concept exploits. The library also includes a ranked list of common sources and sinks, such as `eval` and `document.write`. → portswigger.net |
| 2021-06-05 2021 | Automating Burp Suite -4 | Understanding And Customising Custom Header From intermediate | The content discusses the creation of a Burp Extension using Jython to automate Burp Suite tasks. Specifically, it focuses on adding custom headers to requests. This is the fourth tutorial in the series, emphasizing understanding and customizing custom headers. The tutorial likely provides step-by-step instructions on how to implement this feature within Burp Suite for automated testing and customization purposes. → infosecwriteups.com |
| 2021-05-05 2021 | PimpMyBurp intermediate | PimpMyBurp is a collection of Burp Suite extensions designed to enhance its functionality. It provides a variety of tools to improve the efficiency of security professionals. These extensions offer features for tasks such as advanced scanning, request manipulation, and data analysis, ultimately aiding in the discovery and exploitation of vulnerabilities. |
| 2021-05-04 2021 | Detecting and annoying Burp users intermediate 4 min read | Technique for detecting and disrupting Burp Suite usage, including methods for identifying the web interface via favicon MD5 hashes and localhost resolution, detecting TLS man-in-the-middle with PortSwigger issuer checks and JA3 fingerprinting, exploiting infinitely chunked responses, enumerating EventListeners to detect browser extensions, and leveraging Brotli compression and user-agent discrepancies. It also details ways to break Burp's crawler with unusual characters, confuse its active scanner with delays and collaborator interactions, bypass decoding, and exploit Intruder's marker character handling with PHP. |
| 2021-04-22 2021 | Web App Pentesting With Burp Suite Scan Profiles | White Oak intermediate 2 min read | Reference for configuring Burp Suite scan profiles to enhance web application penetration testing. This document, from White Oak Security, focuses on practical application of Burp Suite features to identify vulnerabilities efficiently. → whiteoaksecurity.com |
| 2020-12-03 2020 | My First Burp Suite Extension beginner 9 min read | Library for creating custom Burp Suite extensions, written in Java. This resource details the process of setting up a Java IDE like Netbeans to debug extensions directly within Burp Suite, implementing the `IBurpExtender` and `IScannerCheck` interfaces, and constructing `IScanIssue` objects to report findings. The example extension checks for the presence of specific response headers during passive scans. |
| 2020-05-30 2020 | BurpSuite Extensions: Some Favorites - VDA Labs intermediate 3 min read | Library of Burp Suite extensions featuring Taborator for out-of-band interactions, JSON Beautifier and .NET Beautifier for improved readability, Active Scan++ for enhanced issue detection including Shellshock, and Freddy for deserialization vulnerabilities. Additional tools like HTML5 Auditor, CSP-Bypass, AWS Security Checks, Retire.js for outdated JavaScript, SSL Scanner for TLS issues, J2EEScan with CVE-2010-1871 and CVE-2011-2730, Error Message Checks, Software Vulnerability Scanner via Vulners.com API, CSRF Scanner, Collaborator Everywhere for backend systems, and Upload Scanner for file upload bypasses are also detailed. |
| 2019-11-14 2019 | PortSwigger Launches Web Security Academy beginner 2 min read | Academy launched by PortSwigger, offering free interactive labs and reading materials to address global cybersecurity talent shortages. The platform features content on clickjacking, WebSocket, HTTP request smuggling, server-side request forgery, and XXE injection, allowing users to practice in a safe, risk-free environment and track their progress. The content will be continually updated to reflect evolving cyber threats. → infosecurity-magazine.com |
| 2019-08-23 2019 | How i exploit out-of-band resource load (HTTP) using burp suite extension plugin (taborator) intermediate | The content discusses exploiting out-of-band resource load using a Burp Suite extension plugin called Taborator. It focuses on the background of the issue, likely related to leveraging HTTP requests to manipulate or extract data from a target system. The use of Burp Suite, a popular web vulnerability scanner, in combination with the Taborator plugin suggests a method for identifying and potentially exploiting vulnerabilities related to out-of-band resource loading. This technique could be used for security testing and identifying weaknesses in web applications. |
| 2019-03-10 2019 | The Top 5 Burp Suite Extensions intermediate 3 min read | Extensions for Burp Suite enhance its capabilities for security researchers. XSS Validator aids in confirming cross-site scripting vulnerabilities by using PhantomJS to verify findings. Burp Notes improves documentation by allowing detailed saving of target and attack information. Sentinel offers a free alternative to Burp Pro's scanner. Random IP Address Header helps evade WAFs by periodically altering the IP address. Bupy and Python Scripter enable custom script development for advanced Burp manipulation. |
| 2018-11-08 2018 | AES-Killer v3.0 - Burp Plugin To Decrypt AES Encrypted Traffic Of Mobile Apps On The Fly intermediate | AES-Killer v3.0 is a Burp plugin designed to decrypt AES encrypted traffic from mobile apps in real-time. This tool allows for the decryption of encrypted data on the fly, aiding in the analysis of mobile app traffic for security testing and debugging purposes. → kitploit.com |
| 2018-06-08 2018 | SleuthQL - Burp History Parsing Tool To Discover Potential SQL Injection Po intermediate | SleuthQL is a tool designed to parse Burp history and identify potential SQL injection points. It aims to assist in discovering vulnerabilities related to SQL injection by analyzing requests and responses within Burp Suite. This tool is useful for security professionals and researchers looking to enhance their testing capabilities and identify potential weaknesses in web applications. → kitploit.com |
| 2016-12-28 2016 | The Top 8 Burp Suite Extensions - Think outside the box intermediate | The content is a title mentioning the top 8 Burp Suite extensions and encourages thinking outside the box when using these tools. It suggests that these extensions can enhance the functionality of Burp Suite, a popular web application security testing tool. The focus is on exploring innovative ways to utilize these extensions to improve security testing processes. |