Burp Suite, the leading toolkit for web application security testing

Burp Suite release notes

Friday, October 21, 2016


This release adds a new Burp Collaborator client for use in manual testing, some new APIs for using Burp Collaborator capabilities within Burp extensions, and a new Burp extension that demonstrates usage of the APIs.

Burp Collaborator client is a tool for making use of Burp Collaborator during manual testing. You can use the Collaborator client to generate payloads for use in manual testing, and poll the Collaborator server for any network interactions that result from using those payloads.

To run Burp Collaborator client, go to the Burp menu and select "Burp Collaborator client".

The following functions are available:
  • You can generate a specified number of Collaborator payloads and copy these to the clipboard. You can use these in manual testing, for example using Burp Intruder or Repeater.
  • You can choose whether the generated payloads include the full Collaborator server location, or only the unique interaction ID.
  • You can poll the Collaborator server to retrieve details of any network interactions resulting from your payloads, either at a regular interval or on demand.

Some new APIs have been added for using Burp Collaborator capabilities within Burp extensions. There is a new method on IBurpExtenderCallbacks:

IBurpCollaboratorClientContext createBurpCollaboratorClientContext();

This creates an IBurpCollaboratorClientContext object that can be used to generate Burp Collaborator payloads and poll the Collaborator server for any network interactions that result from using those payloads.

To demonstrate usage of the new APIs, we have today released to the BApp Store a new extension that can detect the HTTPoxy vulnerability via Burp Collaborator.

The source code to the HTTPoxy Scanner extension is available here.

MD5: df736dbf78bb7fcc26d58f1fa814217a
SHA256: 4d44459c04421c934f0c8e60618e255bd913213ab88021d9eee6f651949bc389

MD5: adad04d39abf937bc7c3fb6f29f28297
SHA256: 629b0c6748b115daa8dc2f31db8c7809485fc6565b82b3b08b1fa6b64bd106ad

MD5: 96a2c68f76cdbe557cada92cf6363359
SHA256: 3df6b8da0a30489368cb9c532185020f4a72ec14f824f8a86072c4ff4c9d4b53

MD5: 1278ef18097e93702371972a5dffc1d8
SHA256: af405f2c2caeff869da58bcdd27b76ad1544b16a6fcbed0f39bfe42173fa3b41

MD5: 2ab5e0e558974ed4f631e6c3c20d2a55
SHA256: 27db96f7bdb6fdb477d77add896f562fb21f819fae7a3144b49aeca3e4c51ab8

Friday, October 14, 2016


This release considerably enhances Burp Scanner's logic for reporting issues with cross-origin resource sharing (CORS) and introduces three new issues:
  • CORS: arbitrary origin trusted
  • CORS: all subdomains trusted
  • CORS: unencrypted origin trusted
There are many subtleties with CORS configuration that are not widely understood but can lead to catastrophic vulnerabilities, as described in today's blog post. This update puts all of the knowledge from this research into Burp so that it can accurately report all of the different problems that can arise with CORS.

MD5: 41d7091e6f726b054a94336eba590eb8
SHA256: 27e53041de128ee92b7faacba6808800bb2be9d4fc827cf62484a5bfb1b6f314

MD5: 56e86cb01563730c6a59bea150dcf8c9
SHA256: 7320d6fdd4192fc34be0b72ce63df09e9c468c5f92a69ac0efaf038d5139b4ff

MD5: eb98fc4432cff3e288afd2bd2b6b3661
SHA256: 5b20bc2f1b236af3049a155fa8f122f5d91097041ebf17964bd640aa439ecaaf

MD5: 7301606590748be43d37a9080d78ba8f
SHA256: fa35a1c19ef7277540b367c36273096e92c97728317e1620a2cb836b76ecfe76

MD5: 22e4f0913a94c734e4083a8dbcc7a01d
SHA256: e3e78068f87f28dd4421d1cc0e9d8f74bfbcd32502300871ee2bf5fa648437cf

Support Center

Get help and join the community discussions at the Burp Suite Support Center.

Visit the Support Center ›

Copyright 2016 PortSwigger Ltd. All rights reserved.