Results

PROFESSIONAL COMMUNITY

Bypassing XSS filters by enumerating permitted tags and attributes

Reflected cross-site scripting (XSS) arises when an application receives data in an HTTP request, then includes that data in its response in an unsafe way. ...

PROFESSIONAL COMMUNITY

Getting started with Burp Sequencer

In this tutorial, you'll use Burp Sequencer to analyze the quality of randomness in an application's session tokens. Note Burp Sequencer may have unexpected ...

PROFESSIONAL COMMUNITY

Loading your extension in Burp

Once your extension is ready, follow these steps to build a JAR file and load it in Burp Suite. Note To ensure compatibility with the latest Montoya API ...

DAST

Migrating to an external database

Self-hosted If you are using Burp Suite DAST's bundled H2 database, you can migrate to an external one at any time. The migration process involves the ...

PROFESSIONAL COMMUNITY

Writing your first Burp Suite extension

This tutorial shows you how to write your first Burp Suite extension in Java using the Montoya API. You'll learn how to: Set your extension's name. Register ...

PROFESSIONAL

Testing for blind XSS

Blind cross-site scripting (XSS) is a type of stored XSS in which the data exit point is not accessible to the attacker, for example due to a lack of ...

PROFESSIONAL COMMUNITY

Evaluating inputs with Burp Suite

Once you have discovered functionality that is worth investigating further, you can use a range of Burp's tools to evaluate the user controllable inputs. ...

PROFESSIONAL COMMUNITY

Configuring Safari to work with Burp Suite

You need to configure Safari so that you can use it for testing with Burp Suite. Note These steps are only necessary if you want to use an external browser ...

PROFESSIONAL COMMUNITY

Testing horizontal access controls

When a user logs in to an application, they usually only have access to their own functions and resources. If access controls are incorrectly set, a user ...

PROFESSIONAL COMMUNITY

Setting up your extension development environment using the starter project

The starter project simplifies extension development using the Montoya API. Instead of setting up your development environment manually, you can download ...