Results

PROFESSIONAL COMMUNITY

Testing for privilege escalation

When a user logs in to an application, they usually only have access to the parts of the application that they need to perform their specific tasks. If ...

PROFESSIONAL COMMUNITY

Testing for directory traversal vulnerabilities with Burp Suite

Directory traversal vulnerabilities (also known as file path vulnerabilities) allow an attacker to read arbitrary files on the server that is running an ...

PROFESSIONAL COMMUNITY

Discovering supported hostnames with Burp Suite

You can use Burp Intruder to discover additional, hidden hosts that are in scope but aren't explicitly linked from the initial set of domains you're ...

PROFESSIONAL COMMUNITY

Creating scripts

Bambdas are lightweight, reusable Java-based scripts that enable you to fine-tune and extend Burp Suite's functionality. They can be used for tasks such as ...

PROFESSIONAL

AI credits

AI credits give you access to Burp Suite's AI-powered features. Whenever you use an AI-powered tool or an extension that interacts with an AI model, credits ...

PROFESSIONAL COMMUNITY

Testing for XXE injection vulnerabilities with Burp Suite

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of ...

PROFESSIONAL

Running a full crawl and audit

Burp Scanner can crawl and audit web applications from one or more start URLs. When scanning, it uses a built-in Chromium browser to interact with the ...

PROFESSIONAL

Creating custom scan checks

Custom scan checks enable you to extend Burp Scanner with your own vulnerability detection logic. You can create two types of custom scan checks: Scripts - ...

PROFESSIONAL COMMUNITY

Configuring an Android device to work with Burp Suite

You can configure an Android device to proxy HTTP traffic through Burp Suite. This enables you to test Android apps just like ordinary websites. The process ...

PROFESSIONAL

Reporting scan results

After you use Burp Scanner to scan a target, you can generate a report in HTML format for some or all of the issues found. This enables you to share the ...