Thank you to those who attended our recent PortSwigginar on Burp Suite Enterprise Edition. Below is the video of the session, which included; A recap on “what’s new” within the tool for those who have

If you've ever installed any Burp extensions from the BApp Store, you'll know that it's a great way to extend your capabilities and tailor Burp Suite to your every need. If you've not, then what are y

Last year we made it significantly easier to find DOM XSS, when we introduced a brand new tool called DOM Invader. This year, we've improved DOM Invader to make finding CSPP (client-side prototype pol

Thank you to those who attended our recent PortSwigginar on Burp Suite Enterprise Edition. Below is the video of the session, which included: A recap on "what's new" within the product for those who h

If you use Burp Suite Professional or Burp Suite Community Edition for manual security testing, then you'll be familiar with tools like Burp Repeater and Burp Intruder. They make life as a tester much

Thank you to those who attended our recent PortSwigginar on Burp Suite Enterprise Edition. Below is the video of the session, which included; A recap on “what’s new” within the product for those who h

The roadmap shown here is out of date. Please see our January 2023 roadmap update. With six (and a bit) months of 2022 already gone, it's time to bring you an update on the latest happenings down at B

It’s been a year since we launched our Burp Suite Certified Practitioner exam, so we’ve been reflecting on some of the improvements and developments we’ve made across both our preparation materials an

Hi, this is my fifth time speaking at Black Hat USA and DEFCON. You can get the slide copy and video there: Let’s Dance in the Cache - Destabilizing Hash Table on Microsoft IIS (slides) Let’s Dance in the Cache - Destabilizing Hash Table on Microsoft IIS (video - TBD) As the most fundamental Data Structure in Computer Science, Hash Table is extensively

We are increasing prices for Burp Suite Professional and Burp Suite Enterprise Edition, due to a significant increase in costs caused by global inflation. The price of an annual Burp Suite Professiona

A custom wordlist generator that creates permutations of all the input words as well as just manipulating them individually

Pipal analysis of a password dump from a dating site.

Pipal analysis of 1800 passwords dumped from Minecraft

Pipal analysis of 13,000 passwords from the Lizard Squad dump.

Pipal analysis of of a password dump from the Neofriends dating site.

A short howto on removing the obfuscation added to non-default passwords by Nessus.

A write up of my recent experiences of getting clients involved during testing.

A short guide to exploiting POST based reflected XSS using CSRF and iframes.

Trying to understand why the EE web portal doesn't have a password change feature.

Asking the question, when it is acceptable to miss a vulnerability on a test.

I've spent the day testing an app which disables the right click context menu, this makes testing tricky so I found a one liner which I could drop into the browser console to re-enable it for me.