Support Center

Burp Community

See what our users are saying about Burp Suite:

How do I?

New Post View All

Feature Requests

New Post View All

Burp Extensions

New Post View All

Bug Reports

New Post View All

Burp Suite Documentation

Take a look at our Documentation section for full details about every Burp Suite tool, function and configuration option.

Full Documentation Contents Burp Projects
Suite Functions Burp Tools
Options Using Burp Suite

Burp Extender

Burp Extender lets you extend the functionality of Burp Suite in numerous ways.

Extensions can be written in Java, Python or Ruby.

API documentation Writing your first Burp Suite extension
Sample extensions View community discussions about Extensibility

Friday, April 7, 2017


This release fixes a bug that was introduced in 1.7.20 relating to configuration of SSL protocols and ciphers.
MD5: 277623002d675591590eaabc0ddc4f6d
SHA256: 92f8f3127ea7503716528e57e849c5514cfd41692d3ab77346d3b23ae98cb847

MD5: 97a21a2d67f77269260cec2d3d39c1c3
SHA256: 54160c183789824d9a75d5dce61990299bfbd2d3167a886b64edffcebef37591

MD5: a44cad25fd5e60f7523d5ca85754f8ad
SHA256: 2824d7651686c65d6161ba95047a2ccdc208bafb2b3b3cfa57132ff84b63cc53

MD5: 38272e3241413c6acae2d659c86ff7e9
SHA256: 94ff5c029ddf273ec79aeda5e49b4623a339ea07133dd773e9e81fc5404aab2f

MD5: b096337d370e28c8f809f73821572ed7
SHA256: e3fa9c8e097fb368569bdd6a24257e7a46a35e6c1f2b072c2ef12496c3981187
MD5: 28d91f937c013c39cd98bedb820016d5
SHA256: 0e5fe4325b7d6a6a65e9edb67e431dc435fea8198e2e701bd7aa398f4168e920

MD5: e4d7a02ea503819cb184ca37f9682499
SHA256: e98593ca2a76e6f6d9b0804cbcab55d8f0a574f83131a326415c2f8f1c67898e

MD5: c7d75718a8b7fe4d0cd9e7f94053a54d
SHA256: cdac5303caa21f9a1c10ba266fc0a8bb14b2b83a495451a6219114eb6b509dd4

MD5: 53295bc1ee8c57882bf239b4b2fc2c68
SHA256: 4677fec46904d597652f0f91fb3965aaa1b577161912165554fd9138bcb6df98

MD5: 63dd904695372c2c62a83da76125e31c
SHA256: c8e9a6a72d97b4f609dc279159e8e04ab5f512435d23925f074c89ae16657448

Thursday, April 6, 2017


This release considerably enhances the detection of blind injection vulnerabilities based on response diffing. Various Burp Scanner checks involve sending pairs of payloads (such as or 1=1 and or 1=2) and looking for a systematic difference in the resulting responses. Previously, Burp used a fuzzy diffing algorithm that analyzed the whole content of responses. This approach has various limitations that can lead to false negatives, such as:
  • Small variations that are insignificant in the context of the whole response content are liable not to trigger the fuzzy diffing threshold, despite being highly significant when their precise syntactic context is taken into account.
  • Situations where application responses vary due to non-deterministic or unrelated factors can lead to large variations that trigger the fuzzy diffing threshold for all payloads, thereby masking other variations that depend systematically on the supplied payload. 
Burp now uses a more granular diffing logic that takes into account all of the response attributes that were previously exposed in the analyzeResponseVariations API and used in our backslash powered scanning research. Variations are separately analyzed for attributes such as tag names, HTTP status code, line count, HTML comments, and many others. This granularity avoids the limitations described above and dramatically improves the accuracy of blind scan checks in many cases.

Additionally, several of the payloads used in diff-based scan checks have been enhanced to ensure that observed differences are indeed the result of injecting into the intended technology, rather than other input-dependent logic. For example, some web application firewalls (lamely) filter input that matches or N=N and cause a different response than is observed for or N=M. Burp's payloads are now intelligent enough to avoid false positives in situations like this.

The scan checks whose logic has improved include: SQL injection, LDAP injection, XPath injection, file path manipulation, User-agent-dependent response, X-forwarded-for-dependent response, and Referer-dependent-response.

We welcome feedback about the real-world performance of the new scanning logic, particularly in relation to false negatives or positives for diff-based injection issues.

Burp Proxy's generated per-host SSL certificates now include the site's commonName in the subjectAlternativeName extension. Apparently fallback to the commonName was deprecated by RFC2818 (in 2000), and browsers have recently decided to implement this.

Burp Collaborator server now has a configurable logging function that can be used for diagnostic purposes. See the Collaborator configuration file documentation for more details.

Various other minor fixes and enhancements have been made.
MD5: ed0d6a96f043ff4143dd28af3b07bec1
SHA256: 0b0053019f451132872d91c3c94bbad64b57e6990716b74f4724d187afc25900

MD5: ecdefeaa0359a25c1efd320bc7ca0b71
SHA256: ac576e85e7e02b6b4bd182198dac29289c171d6e5bf0dffafe1321b67a066364

MD5: e4074c98e1e3e41a2cb4777c83aaf2e0
SHA256: d5d7c93940507fce4ed6db5c0e422ae02bfce0f64af85a92b639054feb81d052

MD5: c4d8375750ac90b551d5dd48c4cce393
SHA256: fc61aafe3f5505db3abe8d370e04293aebd2340dbf6d6d825e75073e7f2ba4a1

MD5: 2f1f672f30bcc8d41e1b387d9402c478
SHA256: 68c182dc44e7d36bc3327b7103b242666b2b083adf096d7d314c119f94904a13
MD5: 7998e5b00e7308dae89fff7b2a6d3c8e
SHA256: 38f05f214b3292b6049c1f33446edba856b2c2d8fc083891c9c8566600016dc6

MD5: bdee19ebbccb76832b1ca79c9dd6f02f
SHA256: 161f69be4c5da6a6de927030d25a72da020e5a81a6c5419c25284a6b41b65808

MD5: 8b2751140a2a2c4f7dc073df122f9a73
SHA256: 5fd7d81ec4a5d0ec50aa3e4a37d26af17faea754b8a5652f9fc9e6842989013b

MD5: 52f0d409464ace54e00dc850be6e0fd5
SHA256: 463a6304978f000ee7fa62c150f4281784669481225ac65d3fe7fe4e3fd8a3ac

MD5: 9ae37b24a92237eea212d919a5161b87
SHA256: bc61f7bc1fa8e0e408a5cf1ebc83688b68d144064f584d15ef66af48e3d606ef