login

Burp Suite, the leading toolkit for web application security testing

Burp Suite release notes

Wednesday, June 11, 2014

v1.6.01

This release contains various enhancements to existing functionality:
  • The Spider's link-discovery engine has been enhanced, and now achieves a WIVET score of 50%. There is more work to do in this area, and improved crawling of JavaScript-driven navigation is in the pipeline.
  • There are new hotkeyable actions to go back and forwards in the Repeater history for the currently displayed tab. Hotkeys can be assigned to these actions at Options / Misc / Hotkeys.
  • The "valid from" time on Proxy-generated CA-signed host certificates has been changed to be 30 days in the past, to reduce problems that can arise when using multiple test machines with different system times.
  • Handling of non-HTTP-compliant messages that use \n instead of \r\n as header delimiters has been improved.
  • A new option has been added to prevent access to the in-browser Proxy interface using a fully-qualified DNS name, to hinder DNS rebinding attacks against it.
Various bugs have been fixed, including:
    • A bug that resulted in a cryptic error message when attempting to restore state from an invalid file that wasn't generated by Burp's save state function.
    • A bug in the Proxy's generation of CA-signed host certificates when the Proxy listener is configured to do host redirection. Previously, the certificate was being generated for the redirected hostname, not the original one requested by the browser, causing a certificate error in the browser.
    • A bug in the Proxy's match/replace function where replacement strings containing regex metacharacters are wrongly handled when doing non-regex-based match/replace.
    • A bug where target host redirection performed by a Burp extension (by modifying the target details for the current request) is not honored when using SSL with an upstream proxy server. Previously, Burp made a CONNECT request using the original hostname, not the modified one.
    • A bug which caused some session handling rules to fail when processing multipart requests containing a file upload parameter.
    MD5: 23f5392b6dc4a41f19c4afc619e8fc3f
    SHA256: acdcf6f40a1152dd72a198869b99d3c6ec82fa9a7281e3d2454e0d475b62c2d5

    Support Center

    Get help and join the community discussions at the Burp Suite Support Center.

    Visit the Support Center ›

    Copyright 2016 PortSwigger Ltd. All rights reserved.