Results

PROFESSIONAL COMMUNITY

Scoping the effort to audit a website

Before you start testing, it's useful to estimate how much time and effort is required to audit the target website. These are some of the factors that have ...

PROFESSIONAL COMMUNITY

Installing Burp's CA certificate in Safari

Before attempting to install Burp's CA certificate, make sure that you have successfully confirmed that the proxy listener is active and have configured ...

PROFESSIONAL COMMUNITY

Submitting scripts to our GitHub repository

Sharing your scripts to our Bambdas repository on GitHub contributes to a shared library of tools for the entire community to use. The submission process is ...

PROFESSIONAL COMMUNITY

Which Burp Suite Mac installer do you need to download?

In 2020, Apple began introducing a new type of processor for its Mac devices. You need to use a different version of the Burp Suite installer depending on ...

PROFESSIONAL COMMUNITY

Becoming a Burp Suite early adopter

There are two release channels for Burp Suite: Early Adopter and Stable. New features are initially released exclusively on the early adopter channel, but ...

PROFESSIONAL COMMUNITY

Installing Burp's CA certificate

Note These steps are only necessary if you want to use an external browser for manual testing with Burp. If you prefer, you can just use Burp's browser, ...

PROFESSIONAL COMMUNITY

Working with WebSocket messages in Burp Repeater

You can use Burp Repeater to manipulate and resend individual WebSocket messages, and analyze the application's responses. To send WebSocket requests with ...

PROFESSIONAL COMMUNITY

Brute-forcing logins with Burp Suite

Although it's far more efficient to first enumerate a valid username and then attempt to guess the matching password, this may not always be possible. Using ...

PROFESSIONAL COMMUNITY

Testing for OS command injection vulnerabilities

OS command injection is a vulnerability that enables an attacker to execute arbitrary operating system (OS) commands on the server that is running an ...

PROFESSIONAL COMMUNITY

Performing HTTP/2-exclusive attacks

When you intercept a request in Burp Proxy, or send it to Burp Repeater, the Inspector enables you to work with HTTP/2 headers and pseudo-headers in a way ...