I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.

This release adds some powerful new Scanner checks based on James Kettle 's talk at Black Hat today. For full details of this awesome new research, see our blog post on practical web cache poisoning.

Burp Scanner is capable of detecting a wide range of vulnerabilities, which are flagged by the scanner as issues. This table lists all vulnerabilities that can be identified by Burp Scanner. It is ...

If you need to use an external browser with Burp instead of Burp's preconfigured Chromium browser, perform the following configuration steps. For the vast majority of users, this process is not ...

Burp Scanner is a web vulnerability scanning tool built into Burp Suite Professional. You can use Burp Scanner to automatically map the attack surface and identify vulnerabilities in both web ...

Burp Collaborator is a network service that enables you to detect invisible vulnerabilities. These are vulnerabilities that don't: Trigger error messages. Cause ...

Burp Suite DAST is designed for automated scanning at any scale and enables integration with your software development processes. Like any security testing software, Burp Suite contains functionality ...

Burp Suite is a Java application and is distributed via native platform installers. However, Burp is also available as a standalone Java executable file, with the ...

BChecks are custom scan checks that you can create and import. Burp Scanner runs these checks in addition to its built-in scanning routine, helping you to target your scans and make your testing ...

Blind cross-site scripting (XSS) is a type of stored XSS in which the data exit point is not accessible to the attacker, for example due to a lack of privileges. To test for blind XSS vulnerabilities, ...

This page answers common questions about how Burp AT and Burp AI keep your testing safe, how you stay in control when using AI features, and how PortSwigger handles the data you send. Both Burp AT and ...

This section describes how to generate Standard and Compliance reports in HTML or PDF format. You can send scan summary reports automatically, by email.