#burpsuite — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #burpsuite, aggregated by home.social.
-
Работа с ГОСТ TLS в реальных проектах: костыли, решения и опыт
Привет, Хабр! Меня зовут Максим Теплых, эксперт по тестированию на проникновение в ИТ-компании Innostage. В этой статье я хочу рассмотреть тему, которая с годами становится все более актуальной — тестирование систем, использующих ГОСТ TLS. Кратко расскажу о самой технологии, а также покажу подходы и наработки, которые применяем на практике. Заранее приношу извинения за объемное и несколько затянутое введение. Хотя изложение начинается не с динозавров и не с истории древней Руси, тему все же необходимо раскрыть с некоторой предыстории.
https://habr.com/ru/companies/innostage/articles/1053246/
#гост_tls #openssl #nginx #burpsuite #прокси #http #ssl #сертификаты #curl
-
What is Web Security and Web Penetration Testing Tools
In this article, I cover essential web penetration testing tools and how they fit into different stages of the assessment process.
https://denizhalil.com/2024/12/19/web-penetration-testing-tools/#CyberSecurity #WebSecurity #Pentesting #BurpSuite #Nmap #SQLMap #BugBounty #RedTeam #InfoSec #EthicalHacking #SecurityTools #DenizHalil
-
What is Web Security and Web Penetration Testing Tools
In this article, I cover essential web penetration testing tools and how they fit into different stages of the assessment process.
https://denizhalil.com/2024/12/19/web-penetration-testing-tools/#CyberSecurity #WebSecurity #Pentesting #BurpSuite #Nmap #SQLMap #BugBounty #RedTeam #InfoSec #EthicalHacking #SecurityTools #DenizHalil
-
🎙️ Join Federico’s Discord talk later today!
As part of #BurpExtensibilityMonth initiatives, our Research Lead and #BurpAmbassador @apps3c is joining #PortSwigger on Discord for “Restoring testability: Handling complex scenarios in Burp Suite with a custom extension”.
Most web and mobile backends and APIs can be assessed effectively with #BurpSuite out of the box. But testers sometimes hit scenarios where standard workflows become impractical, such as encryption, request signing, custom data formats, WAF controls, token handling, and other protections.
In this talk, Federico will explore how custom Burp Suite extensions can integrate those mechanisms directly into your testing workflow, so you can keep using tools like Repeater, Intruder, Scanner, and more as if the underlying complexity was not there.
Expect a real-world inspired scenario, practical design guidance, and plenty of extension-building inspiration.
👉 Register your interest here!
https://discord.com/events/1159124119074381945/1499761261750128670 -
🎙️ Join Federico’s Discord talk later today!
As part of #BurpExtensibilityMonth initiatives, our Research Lead and #BurpAmbassador @apps3c is joining #PortSwigger on Discord for “Restoring testability: Handling complex scenarios in Burp Suite with a custom extension”.
Most web and mobile backends and APIs can be assessed effectively with #BurpSuite out of the box. But testers sometimes hit scenarios where standard workflows become impractical, such as encryption, request signing, custom data formats, WAF controls, token handling, and other protections.
In this talk, Federico will explore how custom Burp Suite extensions can integrate those mechanisms directly into your testing workflow, so you can keep using tools like Repeater, Intruder, Scanner, and more as if the underlying complexity was not there.
Expect a real-world inspired scenario, practical design guidance, and plenty of extension-building inspiration.
👉 Register your interest here!
https://discord.com/events/1159124119074381945/1499761261750128670 -
To kick off his collaboration with @portswigger as a Burp Suite Ambassador, our Research Lead @apps3c just published the 10th article on the creation of extensions for #BurpSuite. Topic: #Burp #AI!
https://hnsecurity.it/blog/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-10/
-
To kick off his collaboration with @portswigger as a Burp Suite Ambassador, our Research Lead @apps3c just published the 10th article on the creation of extensions for #BurpSuite. Topic: #Burp #AI!
https://hnsecurity.it/blog/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-10/
-
📢 I have just released #BurpAnonymizer, a Burp Suite extension that redacts PII, credentials, tokens and other sensitive data from HTTP requests/responses.
With one click, safely share requests and responses in reports, presentations, team reviews, or AI workflows, without exposing secrets and minimizing manual redactions.
🔗 Explore it here: https://github.com/sv1sjp/BurpAnonymizer
#CyberSecurity #BurpSuite #AppSec #Privacy #SecurityTools #web PortSwigger
-
web crawlers really need an option to just consider all "?something" urls as the same as the base URL and skip over them...
Anyone know if you can use #Burpsuite or similar to force a HTTP-301/302 redirect of them back to the base URL?
-
web crawlers really need an option to just consider all "?something" urls as the same as the base URL and skip over them...
Anyone know if you can use #Burpsuite or similar to force a HTTP-301/302 redirect of them back to the base URL?
-
There's a few good things, I appreciate the consistency of right arrow always taking you to message actions or embedded items now, being able to drop into browse mode to look at messages is helpful sometimes, having access to communities is a nice extra.
But some of the previous concerns at times make the UI practically unusable and I'll probably just switch to using the thing in a tab in my browser, given the thing's a web app now anyway.
This is not an old man shaking fists at the cloud post either, heck I use #Burpsuite for fun, I know how to rangle bad or even terrible UIs, and web UIs can be absolutely fantastic and a game changer for productivity with a screen reader. This one, just isn't, and it's not even primarily because of the UI itself, but almost entirely because of the way that UI is being rendered. I will be providing this feedback to the official channels as well of course, and the UI absolutely CAN be used, when it behaves. It's just that for me it often doesn't -
There's a few good things, I appreciate the consistency of right arrow always taking you to message actions or embedded items now, being able to drop into browse mode to look at messages is helpful sometimes, having access to communities is a nice extra.
But some of the previous concerns at times make the UI practically unusable and I'll probably just switch to using the thing in a tab in my browser, given the thing's a web app now anyway.
This is not an old man shaking fists at the cloud post either, heck I use #Burpsuite for fun, I know how to rangle bad or even terrible UIs, and web UIs can be absolutely fantastic and a game changer for productivity with a screen reader. This one, just isn't, and it's not even primarily because of the UI itself, but almost entirely because of the way that UI is being rendered. I will be providing this feedback to the official channels as well of course, and the UI absolutely CAN be used, when it behaves. It's just that for me it often doesn't -
In this latest article in our long-running series on #BurpSuite #Extension #Development, @apps3c illustrates how to extend the Active and Passive Scanner in your favorite #WebApplication #PenetrationTesting tool with Custom Scan Checks:
https://hnsecurity.it/blog/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-9/
Check it out!
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
If anybody is using https://github.com/pentagridsec/PentagridResponseOverview I just pushed an update that removes request parameter names and values in responses so we don't detect reflected parameters as distinct responses #burpsuite #kotlin
-
Burp Suite can be overwhelming for beginners. Caido isn't.
Modern interface, straightforward setup, and built for manual web app testing.
https://hackers-arise.com/web-app-hacking-getting-started-with-caido/#web #pentesting #infosec #cybersecurity #burpsuite #caido #technology
-
#Brida 0.6 is here! The bridge between #BurpSuite and #Frida is now fully compatible with Frida 17+.
As of this release, Brida 0.6 supports only Frida 17 and later. For users who still rely on older Frida versions, Brida 0.6pre remains available on GitHub.
Get the latest release here:
https://hnsecurity.it/blog/brida-0-6-released/Coming soon to the PortSwigger BApp Store (pending approval).
Kudos to our @apps3c for keeping this essential integration tool up to date with Frida's fast-evolving ecosystem!
-
Что такое структура оценки уязвимости
Система оценки уязвимостей — это способ, позволяющий организациям проверить свои системы, сети и приложения на наличие уязвимостей, которыми могут воспользоваться хакеры. Подобно тому, как мы проверяем свои дома на наличие сломанных замков или уязвимых мест, оценка...
#DST #DSTGlobal #ДСТ #ДСТГлобал #уязвимости #безопасность #OpenVAS #NMap #Nessus #QualysGuard #BurpSuite #киберугрозы #FTP #SSH #Telnet
Источник: https://dstglobal.ru/club/1116-chto-takoe-struktura-ocenki-ujazvimosti
-
🐉 Top 10 Kali Linux Tools — Essential Picks
Quick list of 10 widely-used Kali tools for recon, web testing, exploitation, and forensics — use only in labs or with explicit permission. ⚡🛡️
#KaliLinux #PenTesting #InfoSec #EthicalHacking #Nmap #Wireshark #Metasploit #BurpSuite #Hashcat #Forensics
-
🐉 Top 10 Kali Linux Tools — Essential Picks
Quick list of 10 widely-used Kali tools for recon, web testing, exploitation, and forensics — use only in labs or with explicit permission. ⚡🛡️
#KaliLinux #PenTesting #InfoSec #EthicalHacking #Nmap #Wireshark #Metasploit #BurpSuite #Hashcat #Forensics
-
🟠 Burp findings → report-ready in seconds with Pentest-Tools.com 🔵
Our new Burp Suite extension lets you send Audit Issues straight into Pentest-Tools.com with a single right-click.
No exports, no formatting, no friction. Just faster reporting.
🔗 https://github.com/pentesttoolscom/pentest-tools-com-burp-suite-extension
📚 https://support.pentest-tools.com/burp-suite-integration -
🟠 Burp findings → report-ready in seconds with Pentest-Tools.com 🔵
Our new Burp Suite extension lets you send Audit Issues straight into Pentest-Tools.com with a single right-click.
No exports, no formatting, no friction. Just faster reporting.
🔗 https://github.com/pentesttoolscom/pentest-tools-com-burp-suite-extension
📚 https://support.pentest-tools.com/burp-suite-integration -
TurkuSec September Meetup
Date: 04.09.2025 (Thursday)
Time: 17:40 – Onwards"Burp Like a Pro - Tips and tricks from the hood" by Anton Lindholm
"Rust and Software Defenses Against Physical Fault Injection Attacks -- Study of FIH hardening implemented on Caliptra RoT" by Joona Kannisto
MORE INFO AND REGISTRATION: https://turkusec.fi/turkusec-september-meetup-3/
#TurkuSec #Meetup #Turku #Finland #BurpSuite #Rust #RustLang #faultinjection
-
TurkuSec September Meetup
Date: 04.09.2025 (Thursday)
Time: 17:40 – Onwards"Burp Like a Pro - Tips and tricks from the hood" by Anton Lindholm
"Rust and Software Defenses Against Physical Fault Injection Attacks -- Study of FIH hardening implemented on Caliptra RoT" by Joona Kannisto
MORE INFO AND REGISTRATION: https://turkusec.fi/turkusec-september-meetup-3/
#TurkuSec #Meetup #Turku #Finland #BurpSuite #Rust #RustLang #faultinjection
-
¿Quieres ejecutar binarios #linux en #FreeBSD?
Facil:
Como rootsysrc linux_enable=YES
service linux startEso monta los FS necesarios, antes era todo manual
linprocfs on /compat/linux/proc (linprocfs, local)
linsysfs on /compat/linux/sys (linsysfs, local)
devfs on /compat/linux/dev (devfs)
fdescfs on /compat/linux/dev/fd (fdescfs)
tmpfs on /compat/linux/dev/shm (tmpfs, local)pkg install -y linux-rl9 (binarios y librerías de rocky9)
Acá un ejemplo de #burpsuite en #freebsd
-
A todo esto...decidí rehacer todos los laboratorios de #burpsuite, pero con #mitmproxy, hasta ahora todo funciona...es una herramienta mucho más liviana y con todo lo que se necesita para un pentesting web...recomendable...
-
One discipline people in tech world need more then anything is to close the F**** tabs in their browsers.
Why:
Frees RAM so we do not all pretend we "need" 128 GB machines.
Lets you actually run that local LLM or your music player or Adobe or Oracle products (you do you). For the pentesters this free's up more ram for Burp to eat and not burp :P
Lowers cognitive load.
Ends the guilt of the tab you have ignored for six weeks.
Solution:
- Close the damn tab.
- Finished reading it? Close it.
- Not ready to work on it? Do not open it yet.
- Reading later? Bookmark, read‑it‑later app, or let it go.
Set yourself free. RAM returns. Focus returns. Guilt evaporates.
Close the damn tab.
-
One discipline people in tech world need more then anything is to close the F**** tabs in their browsers.
Why:
Frees RAM so we do not all pretend we "need" 128 GB machines.
Lets you actually run that local LLM or your music player or Adobe or Oracle products (you do you). For the pentesters this free's up more ram for Burp to eat and not burp :P
Lowers cognitive load.
Ends the guilt of the tab you have ignored for six weeks.
Solution:
- Close the damn tab.
- Finished reading it? Close it.
- Not ready to work on it? Do not open it yet.
- Reading later? Bookmark, read‑it‑later app, or let it go.
Set yourself free. RAM returns. Focus returns. Guilt evaporates.
Close the damn tab.
-
Burp suite: 18 расширений
Burp Suite — это мощный инструмент для тестирования безопасности веб-приложений, и его функциональность можно значительно расширить с помощью плагинов (расширений). Вот топ расширений для Burp Suite, которые полезны для пентестеров и исследователей безопасности:
-
BashCoreX (live or injected) with GUI lets you install and run apps like Burp Suite and ZAP Proxy, as long as you’ve got space on the live system! 🙌
***They're not included by default, but you can download and install them easily after boot.
The GUI opens up a whole new level of usability 🔥
#BashCoreX #BashCore #Linux #Pentesting #BurpSuite #Zaproxy #LiveOS #CustomISO #Minimalism #OpenSource #CyberSecurity #DevLog
-
BashCoreX (live or injected) with GUI lets you install and run apps like Burp Suite and ZAP Proxy, as long as you’ve got space on the live system! 🙌
***They're not included by default, but you can download and install them easily after boot.
The GUI opens up a whole new level of usability 🔥
#BashCoreX #BashCore #Linux #Pentesting #BurpSuite #Zaproxy #LiveOS #CustomISO #Minimalism #OpenSource #CyberSecurity #DevLog
-
Want to easily speed up your workflow in #BurpSuite? Hotkeys are the answer.
I guarantee most of you didn't even know these settings existed! Go to Settings → User interface → Hotkeys, and look for the actions you use most often.
Learn or set the hotkey and stop clicking around! 🔥🔥🔥
-
Want to easily speed up your workflow in #BurpSuite? Hotkeys are the answer.
I guarantee most of you didn't even know these settings existed! Go to Settings → User interface → Hotkeys, and look for the actions you use most often.
Learn or set the hotkey and stop clicking around! 🔥🔥🔥
-
Which lesser-known Burp extensions do you swear by? Share your favorites below! 👇
-
Which lesser-known Burp extensions do you swear by? Share your favorites below! 👇
-
Big news in the #BashCore project: introducing #BashCoreLX — the same minimal, powerful BashCore, now with a lightweight #LXDE graphical interface!
Tested on my old machine: just 300MB RAM on boot.
Hoping to release a public ISO soon using live-build!It’ll include all BashCore tools +
#Wireshark #OWASPZAP #BurpSuite #FernWiFiCracker #FirefoxESR #Netsurf#Linux #Pentesting #CyberSecurity #LightweightLinux #InfoSec #LiveISO
-
Big news in the #BashCore project: introducing #BashCoreLX — the same minimal, powerful BashCore, now with a lightweight #LXDE graphical interface!
Tested on my old machine: just 300MB RAM on boot.
Hoping to release a public ISO soon using live-build!It’ll include all BashCore tools +
#Wireshark #OWASPZAP #BurpSuite #FernWiFiCracker #FirefoxESR #Netsurf#Linux #Pentesting #CyberSecurity #LightweightLinux #InfoSec #LiveISO
-
Burp MCP Serverを使って自然言語でBurpを操作する 脆弱性診断を自動化したい
https://qiita.com/sigma_devsecops/items/a49b7df6e772256759ee?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items -
#portswigger has released some #ai thingy for #burpsuite. It doesn't do anything on it's own, but the feature is on by default. If you go to the settings to disable it they ask you for feedback why you turn that crap off. Isn't that obvious? No matter the pinky promiss you make to your customers, that you don't store the data or train on it, as soon as you hand it of to an #LLM company we have no idea what happens. AI and customer data don't mix. End. Of. Story. #infosec #security
-
Атака на некоторые уязвимые веб-приложения Vulnhub. Эксплуатация уязвимостей. Часть 6
Всех приветствую, читатели Хабра! Шестая часть анализа защищенности веб-приложений Vulnhub. Ссылки на первые четыре части, советую ознакомиться (в первой части детально разбираю где скачать образы уязвимых машин, как их поднять на докер, и многое другое): https://habr.com/ru/articles/894508/ https://habr.com/ru/articles/895092/ https://habr.com/ru/articles/895856/ https://habr.com/ru/articles/898918/ (это уязвимая ОС на virtualbox) Примечание Правовая информация: Данная статья создана исключительно в ознакомительных/образовательных/развивающих целях. Автор статьи не несет ответственности за ваши действия. Автор статьи ни к чему не призывает, более того напоминаю о существовании некоторых статей в уголовном кодексе РФ, их никто не отменял: УК РФ Статья 272. Неправомерный доступ к компьютерной информации УК РФ Статья 273. Создание, использование и распространение вредоносных компьютерных программ УК РФ Статья 274. Нарушение правил эксплуатации средств хранения, обработки или передачи компьютерной информации и информационно-телекоммуникационных сетей Все атаки я проводил на локальный сервер, внутри моего сетевого интерфейса, на моем компьютере, то есть все действия легитимны. И как всегда просьба не переходить на личности в комментариях, если вы обнаружили ошибку недочет или неточность, просто без оскорблений напишите комментарий или напишите мне личным сообщением. Алгоритм атаки будет следующий:
https://habr.com/ru/articles/902248/
#информационная_безопасность #пентестинг #nmap #dockercompose #сетевые_технологии #burpsuite #cve #vulnhub #уязвимости
-
Атака на некоторые уязвимые веб-приложения Vulnhub. Эксплуатация уязвимостей. Часть 4
Всех приветствую, читатели Хабра! Четвертая часть анализа защищенности веб-приложений Vulnhub. Ссылки на первые три части, советую ознакомиться (в первой части детально разбираб где скачать образы уязвимых машин, как их поднять на докер, и много другое): https://habr.com/ru/articles/894508/ https://habr.com/ru/articles/895092/ https://habr.com/ru/articles/895856/ Примечание Правовая информация: Данная статья создана исключительно в ознакомительных/образовательных/развивающих целях. Автор статьи не несет ответственности за ваши действия. Автор статьи ни к чему не призывает, более того напоминаю о существовании некоторых статей в уголовном кодексе РФ, их никто не отменял: УК РФ Статья 272. Неправомерный доступ к компьютерной информации УК РФ Статья 273. Создание, использование и распространение вредоносных компьютерных программ УК РФ Статья 274. Нарушение правил эксплуатации средств хранения, обработки или передачи компьютерной информации и информационно-телекоммуникационных сетей Все атаки я проводил на локальный сервер, внутри моего сетевого интерфейса, на моем компьютере, то есть все действия легитимны. И как всегда просьба не переходить на личности в комментариях, если вы обнаружили ошибку недочет или неточность, просто без оскорблений напишите комментарий или напишите мне личным сообщением. Алгоритм атаки будет следующий:
https://habr.com/ru/articles/897296/
#информационная_безопасность #пентестинг #nmap #dockercompose #сетевые_технологии #burpsuite #cve #vulnhub #уязвимости
-
Zxc – Rust TLS proxy with tmux and Vim as UI, BurpSuite alternative
-
Zxc – Rust TLS proxy with tmux and Vim as UI, BurpSuite alternative
-
#Burpsuite now has some AI features. They're enabled by default, but supposedly you still need to explicitly activate them. Yet, curiously there still option to prevent "accidental AI use". This doesn't exactly raise my confidence how clear it is when you're using AI or not.
I, for one, flatly reject this new AI feature.
-
#BurpSuite que es posiblemente la herramienta de seguridad de pago con la mejor calidad precio de la historia se ha subido al carro de la IA. Afortunadamente con opt-in porque me pregunto a quién en su sano juicio le parece buena idea enviar el tráfico generado durante un pentest a servidores de OpenAI y Anthropic 🤨
Además han tenido el detalle de poner un kill switch para deshabilitarlo totalmente para evitar activaciones por error. Espero que al menos siga siendo opcional porque me jodería mucho tener que dejar esta herramienta de lado. Hay opciones libres que la suplen razonablemente bien pero no son lo mismo.
https://portswigger.net/burp/documentation/desktop/burp-ai/ai-security-privacy-data-handling
-
Having a bit of a nostalgic talk with the most seasoned colleagues
-
after a lengthy concept review, code review, and QA process, PortSwigger has published the Burp Variables extension to the BApp Store! if you do API testing from Burp, you should look into this productivity extension which allows you to store and reuse variables in your outgoing requests, similar to other API testing clients like Postman and Insomnia. this is a productivity boon because it gives you single place to update ephemeral credential/token values and it helps you keep track of your identifiers & credentials which minimizes false positives. to learn more:
- install the extension from the BApp Store
- see more details at the BApp Store page: https://portswigger.net/bappstore/27f89b068a3045649d4df77a863209c1
- review the source code at the extension's source repo: https://github.com/0xceba/burp_variables#burp #burpsuite #burp_suite #pentesting #pentest #bugbounty #bugbountytips #hacking #cybersecurity #infosec
-
It's scary and surprising how many online shops are vulnerable to #burpsuite because the price and/or discount is defined from the client's request.