Product roadmap

Audit of asynchronous traffic

New feature

Burp Scanner will automatically audit in-scope API requests that are issued from client-side JavaScript using XHR and Fetch.

Message inspector improvements

Feature enhancement

We will make various improvements to the usability of the HTTP message inspector, based on user feedback.

Enhanced Burp Intruder

Feature enhancement

More options for brute forcing and fuzzing. New payload types and placement options, richer results analysis, and incremental saving.

HTTP/2-specific vulnerability reporting

New feature

Burp Scanner will report some new classes of HTTP/2-specific vulnerabilities.

Server-side template injection

Feature enhancement

Burp Scanner will detect injection into a wider range of templating engines, and will employ OAST techniques to detect blind SSTI.

Performance improvements

Feature enhancement

Improved memory and processing efficiency for various Burp features. Users will also gain feedback on any resource-hungry BApps.

HTTP/2-based enhancements

New feature

The HTTP message inspector will be enhanced with new capabilities enabling manual exploitation of HTTP/2-specific vulnerabilities using Burp Repeater. The Burp Extender API will be enhanced to enable HTTP/2-specific attacks.

Payloads within data formats

Feature enhancement

We will improve the placement and encoding of scan payloads within JSON and XML data structures.

Improved scan speed

Feature enhancement

We will further optimize performance in default settings, to enable faster scans without compromising coverage.

DOM testing tools

Done

Add-ons to Burp Suite Professional's embedded browser have enhanced manual testing for DOM-based vulnerabilities.

Integrated SCA capabilities

Done

Perform software composition analysis (SCA) of client-visible code. Report JavaScript libraries in use that contain known vulnerabilities.

API scanning

Done

Enumerate API endpoints to scan APIs in target applications. API scanning utilizes OpenAPI (Swagger) definitions.

Automatic updates

Done

Update without lifting a finger. Burp Suite Professional can now update itself automatically - without user intervention.

New web cache poisoning scan checks

Done

Find cutting-edge vulnerabilities with Burp Scanner. Scan checks based on James Kettle's latest web cache poisoning research.

Browser-powered scanning by default

Done

Best-in-class coverage and scanning performance for challenging targets like AJAX-heavy single page app, with browser-driven (Chromium) scanning. Enabled by default.

Read all release notes

Improved SPA scanning

Done

Burp Scanner now handles navigational actions that cause DOM updates without a synchronous request to the server, allowing better handling of single-page applications.

Native HTTP logging

Done

Based on the user popularity of certain BApps (Logger++ and Flow), Burp Suite Professional has gained native, resource-efficient logging functionality.

HTTP/2 support

Done

Use HTTP/2 for both inbound and outbound communication over TLS (beta feature). Also gives control of TLS protocols within Burp Proxy.

Inspector view

Done

Manipulate browser traffic more easily. Improved access to headers, parameters, and more - plus automatic encoding and decoding.

Render pages within Burp tools

Done

See exactly what you're looking at - without changing tab. Tools like Burp Repeater and Burp Intruder now allow you to render responses.

Pretty printing in the HTTP message editor

Done

Make code easier to work with. Burp Suite will prettify JSON, XML, HTML, CSS, and JavaScript within the HTTP message editor.

Improved navigational coverage

Done

Burp Scanner now detects and interacts with more DOM elements that can cause JavaScript-triggered navigation, in addition to conventional links and forms.

Early adopters releases

Done

All Burp Suite Professional users now gain access to an optional early adopters' release track - giving early access to new and experimental features.

Recorded login sequences

Done

Better scrutinize login-related functionality by recording complex login sequences in a browser. Ideal for JavaScript-heavy logins, or single sign-on.

Embedded browser for manual testing

Done

Proxy HTTPS traffic with no configuration necessary. Burp Suite's embedded Chromium browser can now take care of everything.

Browser-powered scanning enhancements

Done

Significant improvements to Burp Scanner - enabling enhanced performance and coverage of modern navigational patterns.