Results

PROFESSIONAL COMMUNITY

Scoping the effort to audit a website

Before you start testing, it's useful to estimate how much time and effort is required to audit the target website. These are some of the factors that have ...

PROFESSIONAL COMMUNITY

Submitting scripts to our GitHub repository

Sharing your scripts to our Bambdas repository on GitHub contributes to a shared library of tools for the entire community to use. The submission process is ...

PROFESSIONAL

Active scan check worked example

You can extend Burp Scanner by writing your own scan checks. A custom scan check can report new security issues that Burp doesn't detect natively. In this ...

PROFESSIONAL

Testing for asynchronous OS command injection vulnerabilities with Burp Suite

Asynchronous OS command injection vulnerabilities occur when an application is vulnerable to command injection, but the command is executed asynchronously. ...

PROFESSIONAL COMMUNITY

Creating Burp extensions

Burp extensions are flexible and powerful plugins that enable you to customize Burp Suite to suit your workflow. You can create your own extensions in Java ...

PROFESSIONAL COMMUNITY

Enumerating usernames with Burp Suite

You can use Burp Intruder to insert a list of possible usernames into an authentication mechanism, such as a login form or registration form. This enables ...

PROFESSIONAL COMMUNITY

Testing for stored XSS with Burp Suite

Stored XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. In a ...

PROFESSIONAL COMMUNITY

Testing for DOM XSS with DOM Invader

DOM-based XSS (DOM XSS) arises when an application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by ...

PROFESSIONAL COMMUNITY

Testing for prototype pollution with DOM Invader

Prototype pollution is a JavaScript vulnerability. It enables an attacker to add arbitrary properties to global object prototypes, which may then be ...

PROFESSIONAL COMMUNITY

Scope

The Target > Scope tab enables you to tell Burp Suite which hosts and URLs you want to test. This has a number of advantages. For example, you can: Apply ...