Support Center

Burp Community

See what our users are saying about Burp Suite:

How do I?

New Post View All

Feature Requests

New Post View All

Burp Extensions

New Post View All

Bug Reports

New Post View All

Burp Suite Documentation

Take a look at our Documentation section for full details about every Burp Suite tool, function and configuration option.

Full Documentation Contents Burp Projects
Suite Functions Burp Tools
Options Using Burp Suite

Burp Extender

Burp Extender lets you extend the functionality of Burp Suite in numerous ways.

Extensions can be written in Java, Python or Ruby.

API documentation Writing your first Burp Suite extension
Sample extensions View community discussions about Extensibility

Wednesday, June 11, 2014


This release contains various enhancements to existing functionality:
  • The Spider's link-discovery engine has been enhanced, and now achieves a WIVET score of 50%. There is more work to do in this area, and improved crawling of JavaScript-driven navigation is in the pipeline.
  • There are new hotkeyable actions to go back and forwards in the Repeater history for the currently displayed tab. Hotkeys can be assigned to these actions at Options / Misc / Hotkeys.
  • The "valid from" time on Proxy-generated CA-signed host certificates has been changed to be 30 days in the past, to reduce problems that can arise when using multiple test machines with different system times.
  • Handling of non-HTTP-compliant messages that use \n instead of \r\n as header delimiters has been improved.
  • A new option has been added to prevent access to the in-browser Proxy interface using a fully-qualified DNS name, to hinder DNS rebinding attacks against it.
Various bugs have been fixed, including:
    • A bug that resulted in a cryptic error message when attempting to restore state from an invalid file that wasn't generated by Burp's save state function.
    • A bug in the Proxy's generation of CA-signed host certificates when the Proxy listener is configured to do host redirection. Previously, the certificate was being generated for the redirected hostname, not the original one requested by the browser, causing a certificate error in the browser.
    • A bug in the Proxy's match/replace function where replacement strings containing regex metacharacters are wrongly handled when doing non-regex-based match/replace.
    • A bug where target host redirection performed by a Burp extension (by modifying the target details for the current request) is not honored when using SSL with an upstream proxy server. Previously, Burp made a CONNECT request using the original hostname, not the modified one.
    • A bug which caused some session handling rules to fail when processing multipart requests containing a file upload parameter.
    MD5: 23f5392b6dc4a41f19c4afc619e8fc3f
    SHA256: acdcf6f40a1152dd72a198869b99d3c6ec82fa9a7281e3d2454e0d475b62c2d5