PortSwigger @PortSwigger Twitter profile

Last Seen Profiles

@friendsofadik

@011Dzs

@bettyjo62

@DemsKeys

@RnbwMelodiesMom

@crsiopa

@vaskFPS

@irspireland

@cuddlekentin

@Nameless_Benji_

@Deanogormano

@v42gg

@_CoachFlores_

@opl_224

@bucksfreepress

@Oxfam

@SlatDontMiss

@qaoirei

@Bibliomaniatico

@GIANTS848556321

@Herokomali

@Dayod1adeneye

@poetryofmin

@RevoltToEarn

@AsaadJr

@prima_sulistya

@RachelYeat64725

@drawing_whale

@Satoshiairlines

@Susu_jpg

@arjun2658299847

@ilovezerosomuch

@EWycliffej40426

@wilplatypus

@SherifRAyad

@lariojaMeteo

PortSwigger

@PortSwigger

3 years

Introducing DOM Invader: DOM XSS just got a whole lot easier to find

Introducing DOM Invader: DOM XSS just got a whole lot easier to find

Of the three main types of XSS, DOM-based XSS is by far the most difficult to find and exploit. But we come bearing good news! PortSwigger just released a new tool for Burp Suite Professional and Burp

portswigger.net

9

237

601

PortSwigger

@PortSwigger

3 years

NEW CERTIFICATION ALERT! The new Burp Suite Certified Practitioner certification launches today! Learn more and get your exam here! 🎆 #burpsuitecertified

24

203

566

PortSwigger

@PortSwigger

3 years

Fancy getting Burp Suite Certified for free? Book, take, and pass your exam before 15th Dec 2021 and we'll refund you your $99. Who's ready for the challenge? #burpsuitecertified

26

143

494

PortSwigger

@PortSwigger

5 years

To the very many people who’ve requested a third edition of The Web Application Hacker’s Handbook … I’ve decided not to do one. Instead I’m working on something way more exciting. Details to follow.

16

70

409

PortSwigger

@PortSwigger

2 years

Wait, could this actually be Burp Suite... #tease

24

31

397

PortSwigger

@PortSwigger

4 years

Blog post: Burp Suite tips from power user and "hackfluencer" Stök

Burp Suite tips from power user and "hackfluencer" Stök

In his own words, Stök is "that hacker that your friends told you about". In other words, he's a content creator with over 25 years of experience in the IT industry. He creates education, tutorial, an

portswigger.net

4

92

376

PortSwigger

@PortSwigger

4 years

To all the bug bounty hunters out there: How would you recommend bounty hunters find their very first bug? How did you find your first paid bug? #bugbounty #bugbountytips

21

78

344

PortSwigger

@PortSwigger

2 years

Manual testing with Burp Repeater is now more efficient than ever. Free up screen space by organizing tabs into color-coded groups and collapsing them into a single scrollable row. You can now even search for tabs and groups by name.

12

67

347

PortSwigger

@PortSwigger

6 years

Pressure’s on in the @Burp_Suite office.

11

61

346

PortSwigger

@PortSwigger

5 years

We have added a new technique by @fasthm00 to Exploiting CORS misconfigurations for Bitcoins and bounties

3

135

330

PortSwigger

@PortSwigger

2 years

PortSwigger has today donated $225,000 to the International Red Cross @ICRC to support their work helping the victims of the attack on Ukraine. Half of this money came from the @PortSwiggerRes bug bounty fund, and this amount was matched by the @PortSwigger business.

4

50

309

PortSwigger

@PortSwigger

2 years

If you often find yourself dealing with too many Repeater tabs, then you're going to love Burp's new tab grouping feature.

9

51

287

PortSwigger

@PortSwigger

5 years

We have updated our guide on how to become a web security researcher

0

107

280

PortSwigger

@PortSwigger

3 years

@rana__khalil We quite agree! And since we aren't crazy, we'd love to talk about this. Please could you email support @portswigger .net and we'll take things from there?

13

5

258

PortSwigger

@PortSwigger

2 months

Are CSP's getting in the way of scoring that Bug Bounty you have been working on? 😫 Lucky for you, our research team ( @PortSwiggerRes ) has released some new techniques using Form Hijacking to bypass that protection and get you hacking again; enjoy!

Using form hijacking to bypass CSP

In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re

portswigger.net

2

60

233

PortSwigger

@PortSwigger

4 years

PortSwigger is now on YouTube. Please do check us out and subscribe, to watch the latest updates on @Burp_Suite , @WebSecAcademy , @PortSwiggerRes , and more.

PortSwigger

PortSwigger is a leading provider of software and learning on web security. We make Burp Suite, The Daily Swig, and the Web Security Academy.

www.youtube.com

8

57

220

PortSwigger

@PortSwigger

3 years

On the first day, PortSwigger created Burp Suite. On the second day, we gave you the Web Security Academy. What do you think is next? #newproductlaunch #burpsuite #websecurityacademy

22

30

199

PortSwigger

@PortSwigger

4 years

We're pleased to share our product roadmap for 2020, highlighting what's on the way for Burp Suite Enterprise Edition, Burp Suite Professional, and Burp Scanner.

Burp Suite roadmap for 2020

We have big plans for Burp Suite during 2020, aimed at improving its value to professional testers, software development teams, and businesses with web assets to protect. Here, we’re sharing some key

portswigger.net

12

71

195

PortSwigger

@PortSwigger

3 years

We’re excited to announce our “women in tech” university scholarship scheme, offering £70,000 of financial support to help young women get started in a tech career. (Near Manchester, UK.)

Women in Tech

An opportunity to kick-start their tech career, through financial support and paid work, at PortSwigger - a high-tech North West software business.

portswigger.net

7

58

187

PortSwigger

@PortSwigger

4 years

It’s BlackHat week and we have some huge things to share: - Conference talk by @albinowax - Blog post with full details - @WebSecAcademy update with labs on brand new vulnerabilities - @Burp_Suite update with scan checks for new issues - Director’s cut of James’s talk on YouTube

3

39

176

PortSwigger

@PortSwigger

2 years

We've slashed the price of our Burp Suite Certified Practitioner exam for Black Friday, and we'll still refund you if you pass. What are you waiting for? #burpsuitecertified #BlackFriday

35

77

180

PortSwigger

@PortSwigger

3 years

Blog post: mapping out Burp Suite's crawler. This is a deep dive into the crawler, which is at the heart of Burp Suite's capabilities, and covers the crawler's origins, its current state and plans for the future.

Web application cartography: mapping out Burp Suite’s crawler

At the core of Burp Suite is Burp Scanner - a powerful tool designed to reduce the number of manual steps users have to take to discover vulnerabilities in their targets. Burp Scanner was first releas

portswigger.net

2

72

178

PortSwigger

@PortSwigger

3 years

For the record, we have no plans ever to charge for access to Web Security Academy labs. The low price of the certification covers the exam proctoring and infrastructure costs.

8

17

173

PortSwigger

@PortSwigger

2 years

Introducing in-app recon to the Web Security Academy, with the brand new mystery lab challenge! This new feature gives academy users the chance to find and exploit vulnerabilities by generating a random lab to test their skills. #mysterylabchallenge

Introducing the mystery lab challenge

For anyone who's used the Web Security Academy before, you'll be pretty familiar with the format. For those of you who haven't had the pleasure, the process goes a little bit like this: Select a set o

portswigger.net

2

43

172

PortSwigger

@PortSwigger

3 years

We're looking for interesting and helpful videos/guides on using Burp Suite as a pentester - what have you all got? Share links to your favourites in the comments below ... #burpsuite

16

43

168

PortSwigger

@PortSwigger

2 years

Just to be clear. To pass the Burp Suite certification exam, you will need access to Burp Suite Pro. It doesn’t matter if it is paid or trial or your work license or anything else. We don’t check your subscription. It’s just impossible to pass the exam without Burp Suite Pro.

11

29

170

PortSwigger

@PortSwigger

4 years

Blog post: Finding your first bug: bounty hunting tips from the Burp Suite community

2

71

158

PortSwigger

@PortSwigger

11 months

Introducing BChecks - a new, faster way to add your own scan checks to Burp Scanner. Create your first BCheck today:

BChecks: Houston, we have a solution!

Scripted scan checks in Burp Suite Professional are now a thing ... tl;dr Burp Suite Professional now has a powerful yet simple scripting language that allows you to quickly build on our world c

portswigger.net

7

45

156

PortSwigger

@PortSwigger

7 years

I originally wrote Burp to make my day job easier. Glad to hear it’s helping others.

Tim Tomes

@LaNMaSteR53

7 years

Was just sitting here pondering how difficult my job would be without Burp Suite. Thank you @PortSwigger . Seriously. Thank you.

1

5

35

6

19

155

PortSwigger

@PortSwigger

4 years

Burp Scanner now lets you record login sequences using your browser, so you can work with non-standard login mechanisms, single sign-on services, and other challenges.

Burp Suite

@Burp_Suite

4 years

Burp Suite Pro/Community 2020.9.2 released, with support for recorded login sequences in Burp Scanner and various bug/security fixes.

5

45

149

2

40

149

PortSwigger

@PortSwigger

2 years

Finding Client-Side Prototype Pollution (CSPP) with DOM Invader by @garethheyes - now available on the Early Adopter channel

Finding client-side prototype pollution with DOM Invader

Last year we made it significantly easier to find DOM XSS, when we introduced a brand new tool called DOM Invader. This year, we've improved DOM Invader to make finding CSPP (client-side prototype pol

portswigger.net

2

46

147

PortSwigger

@PortSwigger

2 years

For everyone who has a Burp Suite Certified Practitioner exam ready to take, we wanted to share a couple of exam pre-prep top tips. We've added some advice from people who've passed already - if you've got any tips then share them below! #burpsuitecertified

14

34

144

PortSwigger

@PortSwigger

3 years

Burp Suite Professional has plenty to learn - so we put our heads together and created a list of resources to help you get started. Anything to add to the list? #BurpSuiteTips #burpsuite

4

43

140

PortSwigger

@PortSwigger

2 years

"Hunting evasive vulnerabilities: finding flaws that others miss" - from @albinowax - will be premiering at @nullcon Berlin in just a few days. If you can't catch the live event, it'll be available on YouTube post-conference.

Upcoming Conference Talks - PortSwigger Research

portswigger.net

9

25

138

PortSwigger

@PortSwigger

3 years

Wondering how to enable DOM Invader? Well, it's available in the early adopter release. So you get it by using the early adopter channel.

4

37

132

PortSwigger

@PortSwigger

2 years

Evaluating an automated web vulnerability scanner? Use our new to put your scanner to the test. This is a realistic example of a modern website, containing serious vulnerabilities you might encounter in the wild.

4

28

125

PortSwigger

@PortSwigger

2 years

This is a Burp extension, and it's only a prototype currently - check it out and feel free to share your thoughts with us!

PortSwigger Research

@PortSwiggerRes

2 years

We've prototyped a new feature in repeater where we are diffing the last response with the current and showing different colours depending on what changes. Please check it out we'd love your feedback!

22

86

574

1

14

124

PortSwigger

@PortSwigger

3 years

Burp house, in the middle of Burp street ... we’re getting pretty excited about our new office now!

The house that Burp built - PortSwigger's new office

We're excited to share a preview of our brand new offices!Set in 200 acres of open parkland, our modern building has been designed just for us to support the...

www.youtube.com

9

16

119

PortSwigger

@PortSwigger

5 years

It’s official. Burp Suite detects everything except pregnancy.

whitney🧜🏽‍♀️

@_whit_ney_m

5 years

@Burp_Suite Why can’t you detect pregnancy 🤰 LOL

1

6

28

6

21

119

PortSwigger

@PortSwigger

3 years

🎵 If you're having cert issues I feel bad for ya son, I got $99 problems but the bill ain't one...🎵 All you have to do is pass the Burp Suite cert exam before 15th Dec and we'll refund you your $99 exam fee. #burpsuitecertified #99problems

7

37

120

PortSwigger

@PortSwigger

3 years

Want more attack surface? DOM Invader's got you covered. It'll help discover JavaScript based parameters automatically, and show them in the URLSearchParameters source in the tree view.

3

32

108

PortSwigger

@PortSwigger

2 years

Last few days to try your hand at @RealTryHackMe 's Advent of Cyber challenge. There are Burp Suite certification exams up for grabs as part of the prize pool... #adventofcyber #burpsuitecertified

Advent of Cyber 2023

Dive into Christmas with festive beginner-friendly security challenges released daily throughout December, and win big with over $50,000 worth of prizes!

tryhackme.com

3

18

109

PortSwigger

@PortSwigger

4 years

You asked, we answered. Watch Burp Suite creator @DafyddStuttard talk about how Burp started, where the name PortSwigger came from, who Peter Wiener is, getting started in pen testing, the sinister Carlos, and more. #AskMeAnything

Ask me anything, with Burp Suite creator Dafydd Stuttard

Watch Burp Suite creator and Web Application Hacker's Handbook author, Dafydd Stuttard, answer questions submitted by Burp users on Twitter. Links to specifi...

www.youtube.com

7

28

109

PortSwigger

@PortSwigger

3 years

Want to see if a sink is vulnerable?? Either inject the canary and additional characters, or set the canary to include them. You could even use JavaScript URLs as a canary - "javascript:burpdomxss".

0

28

106

PortSwigger

@PortSwigger

2 years

Blog post: Burp Suite roadmap for 2022

Burp Suite roadmap for 2022

The roadmap shown here is out of date. Please see our July 2022 roadmap update. With 2022 now underway, it's about time we gave you the latest on where Burp Suite is heading this year. Here we take a

portswigger.net

1

25

97

PortSwigger

@PortSwigger

3 years

Want to find JSON data structures automatically? Settings > "generate automated messages", to set DOM Invader guessing message structures using specially crafted JavaScript. Click the link below with DOM Invader and post message options enabled:

1

21

93

PortSwigger

@PortSwigger

3 months

Interested in learning how to extract sensitive data from websites when JavaScript is not an option? Our very own @garethheyes has published some new techniques on how to achieve this using Blind CSS Exfiltration. Come and take a look 👀

Blind CSS Exfiltration: exfiltrate unknown web pages

This is a gif of the exfiltration process (We've increased the speed so you're not waiting around for 1 minute). Read on to discover how this works... CSS Cafe presentation I presented this technique

portswigger.net

2

19

92

PortSwigger

@PortSwigger

9 months

Introducing multiple new classes of web race condition, that go far beyond limit-overrun exploits and expose previously overlooked attack surface, alongside new Burp Suite tooling and a brand new set of labs and learning materials.

New techniques and tools for web race conditions

For too long, web race-condition attacks have focused on a tiny handful of scenarios. Testing for them is inherently unreliable, compounded by known challenges relating to time constraints and network

portswigger.net

0

24

91

PortSwigger

@PortSwigger

2 years

It's no bug folks, we actually are offering our certification for just $9 - and if you pass before 15 December '21 we'll still refund you! #burpsuitecertified

8

24

89

PortSwigger

@PortSwigger

8 months

Calling all Pro/Community users... As part of our table enhancement work, we'd like to know - are tables easier to read with or without zebra stripes? Follow this link to cast your vote 👉

26

10

88

PortSwigger

@PortSwigger

4 years

PortSwigger is now on YouTube! Do subscribe to see updates on Burp Suite, the Web Security Academy, and PortSwigger research.

PortSwigger

PortSwigger is a leading provider of software and learning on web security. We make Burp Suite, The Daily Swig, and the Web Security Academy.

www.youtube.com

0

18

86

PortSwigger

@PortSwigger

1 year

Using the Server-Side Prototype Pollution Scanner

Server-Side Prototype Pollution Scanner

We recently published some research on server-side prototype pollution where we went into detail on techniques for detecting this vulnerability black-box. To make your life easier, we've integrated th

portswigger.net

0

20

85

PortSwigger

@PortSwigger

6 years

Burp’s UI is getting nicer.

Burp Suite

@Burp_Suite

6 years

Blog post: The new dashboard #MoBP #BurpSuite

9

129

345

6

20

78

PortSwigger

@PortSwigger

2 years

At Black Hat 2021 @PortSwiggerRes introduced multiple new classes of HTTP/2-exclusive threats and showed how these flaws enable desync attacks. Catch up on these before @albinowax presents the next stage of the journey, Browser-Powered Desync Attacks.

HTTP/2: The Sequel is Always Worse

In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.

portswigger.net

8

21

78

PortSwigger

@PortSwigger

2 years

You can now use DOM Invader to test for client-side prototype pollution. For an overview of how to use the exciting new features from PortSwigger researcher and creator of DOM Invader, Gareth Heyes, check out the following video.

2

20

77

PortSwigger

@PortSwigger

1 year

Despite being seemingly counterintuitive, starting again from scratch actually presented us with an opportunity to improve code and functionality at a scale not normally possible. And now? It's time to welcome browser-powered scanning 2.0.

Browser powered scanning 2.0

It's been two years since we unleashed browser powered scanning on the world, and we decided what better way to celebrate than to start again from scratch! It started out as a task, how did it end up

portswigger.net

0

26

77

PortSwigger

@PortSwigger

3 years

Blog post: Web Security Academy - your questions answered. @WebSecAcademy

Web Security Academy - your questions answered

We're nearly at 200 labs on our ever-popular Web Security Academy, so before we hit that magic number we wanted to give you the chance to get your questions answered. This blog post answers your most-

portswigger.net

0

19

77

PortSwigger

@PortSwigger

3 years

Burp Suite Pro users, we're talking to you. Are there any videos or blogs that you would recommend to first-time users to help them get to know Burp?? #burpsuite

14

10

78

PortSwigger

@PortSwigger

3 years

We're excited to share our Burp Suite roadmap for 2021.

Burp Suite roadmap for 2021

This roadmap has now been updated. Please see our July 2021 roadmap update. We’re all hoping that 2021 will prove to be a better year for humanity. And we’re also planning a great year for Burp Suite!

portswigger.net

6

24

76

PortSwigger

@PortSwigger

3 years

A sneak preview of the latest research from @albinowax - that he'll be unveiling at this year's BlackHat USA event - along with some very exciting product development news! #blackhatusa #burpsuite #appsec

Black Hat USA 2021: PortSwigger's latest research to be unveiled

Two years ago, PortSwigger's director of research James Kettle presented "HTTP Desync Attacks" on-stage at BlackHat USA and kicked off a wave of request smuggling, but at that time HTTP/2 escaped seri

portswigger.net

0

20

76

PortSwigger

@PortSwigger

4 years

ICYMI @Burp_Suite Professional and Community Edition now pretty-print JSON, CSS, JavaScript, HTML, and XML automatically.

4

20

70

PortSwigger

@PortSwigger

3 years

For anyone who started using Burp this year, what has been the hardest part of getting started? #burpsuite

30

7

72

PortSwigger

@PortSwigger

3 years

Who's geared up to take their certification exam? Don't forget, if you book and pass before 15th Dec we'll refund your exam fee! Put your skills to the test now with our practice exam ... 💻📖 #burpsuitecertified

Practice Exam - Burp Suite Certified Practitioner | Web Security Academy

Get yourself fully prepared to take the Burp Suite Certified Practitioner exam with our practice exam.

portswigger.net

2

15

68

PortSwigger

@PortSwigger

2 years

Our expensive lawyers have brought it to our attention that you are passing off a bodily part as a PortSwigger product. We demand that you desist and remove our trademark from your limb (or the limb itself) within 7 days. #April1

6

64

PortSwigger

@PortSwigger

4 years

Are you familiar with all of Burp Suite's WebSockets features? Watch this video to see why Burp is so powerful for WebSockets security testing and can find bugs that other tools miss.

Burp Suite

@Burp_Suite

4 years

Burp Suite essentials #10 : How to test WebSockets

0

75

163

0

19

67

PortSwigger

@PortSwigger

30 days

Scanning from an API definition is now possible in Burp Suite Pro. Thanks for having a little patience 😉

Burp Suite's new API scanning, could it be magic?

Scanning from an API definition is now possible in Burp Suite Pro. Thanks for having a little patience 😉#Shorts

www.youtube.com

1

14

70

PortSwigger

@PortSwigger

3 years

#newproductlaunch #burpsuite #websecurityacademy

7

3

68

PortSwigger

@PortSwigger

3 years

Be one of the first 100 people to become a Burp Suite Certified Practitioner, and get a limited-edition, exclusive swag bundle to show off your new certification! #burpsuitecertified

1

8

69

PortSwigger

@PortSwigger

3 years

#newproductlaunch #burpsuite #websecurityacademy

2

3

67

PortSwigger

@PortSwigger

3 years

Burp Suite Certified Practitioner | Web Security Academy

Become a Burp Suite Certified Practitioner to demonstrate and prove your web security testing skills.

portswigger.net

1

17

67

PortSwigger

@PortSwigger

7 years

If you see any of the @Burp_Suite team at #bhusa17 come say hello.

3

23

67

PortSwigger

@PortSwigger

3 years

You asked. We delivered. Well, we will be very soon. The latest workings from the incredible minds of PortSwigger Research, coming soon to a computer near you. #newproductlaunch #burpsuite #websecurityacademy

2

67

PortSwigger

@PortSwigger

3 years

Help us to shape the future of Burp Suite, and build your very best product experience... #burpsuite #productexperience #feedbackmatters

7

24

63

PortSwigger

@PortSwigger

3 years

Let's close the week out with something useful - thanks to a fantastic tweet thread from Burp user @codingo_ we've got a great list of tips and tricks for you all 👌 #BurpSuiteTips #burpsuite

0

22

63

PortSwigger

@PortSwigger

2 years

It's that funny time of year when life is in limbo, so why not work through some of the labs in our Web Security Academy? Follow the learning path, track your progress, and make sure to delete Carlos! #websecurityacademy #vulnerabilities

All Web Security Academy topics | Web Security Academy

An overview of all topics, from beginner to expert level, through the Web Security Academy - brought to you by PortSwigger. Create an account to get started.

portswigger.net

4

12

62

PortSwigger

@PortSwigger

3 years

One of our team's most popular breakthroughs so far is now six years old. Don't let age fool you though, Burp Collaborator still rules the roost. #burpsuite

0

8

62

PortSwigger

@PortSwigger

3 years

We interviewed three of the high flyers in our Hall of Fame, to find out exactly what inspired them to get ahead of the game in web security. #websecurity

Flying high in the Web Security Academy

We caught up with three high-flyers in our Web Security Academy - at the time of interview, they were ranked 2nd, 4th, and 6th out of thousands of users. If you want the full story, including some ins

portswigger.net

1

15

62

PortSwigger

@PortSwigger

1 year

So long, and thanks for all the fish. A sad day today as we say goodbye to The Daily Swig - the team have provided the community (and us) with five and a half years' worth of high-quality news, and we're sorry tto announce that this journey has ended.

We’re going teetotal: It’s goodbye to The Daily Swig

PortSwigger today announces that The Daily Swig is closing down

portswigger.net

5

8

62

PortSwigger

@PortSwigger

3 years

Want to see every sink that a site uses? Simply enable DOM Invader, set the canary value to an empty string, then sit back and observe the site sinks …

1

10

60

PortSwigger

@PortSwigger

4 years

Learn how to bypass password logins, avoid account lockout, and defeat two-factor authentication in our awesome new #WebSecurityAcademy topic and labs.

Web Security Academy

@WebSecAcademy

4 years

We've added a brand new topic on authentication vulnerabilities, including 14 new labs!

6

113

386

5

13

60

PortSwigger

@PortSwigger

3 years

We recently caught up with Corey Ball - cybersecurity consultant, author, and API hacker extraordinaire - to discuss all things API security. #APIsecurity

Hack your APIs: interview with Corey Ball - API security expert

Corey Ball is a Cybersecurity Consulting Manager, and author of the forthcoming book Hacking APIs (working title - No Starch Press). As well as being a long-time API hacking enthusiast, Corey’s role g

portswigger.net

0

17

61

PortSwigger

@PortSwigger

3 years

How to get real good at hacking: 1. Turn on dark mode in Burp Suite. 2. Follow our @WebSecAcademy learning path. 3. Smash those labs. #hacking #advice #darkmode

4

17

61

PortSwigger

@PortSwigger

4 years

Anybody in the mood for a PortSwigger promo party? Watch this space to find out what we’ve got in store for you next week … #WebSecurityAcademy #LockdownLearning #getswiggywithit

1

7

57

PortSwigger

@PortSwigger

3 years

Find out how browser-powered scanning works under the hood, why this approach is essential for scanning modern web applications, and our exciting plans for building on this foundation.

Browser powered scanning in Burp Suite

Since the release of Browser powered scanning back in Burp Suite Professional 2020.8.1 we have had a lot of customers asking us about our motivation for choosing to integrate with Chromium and fo

portswigger.net

0

21

56

PortSwigger

@PortSwigger

5 years

The state of the art on blind XXE exploitation has come a long way since I wrote WAHH. Learn about the latest techniques, including one from @_mohemiv that features in @Burp_Suite ’s top ten hacking techniques of 2018.

What is a blind XXE attack? Tutorial & Examples | Web Security Academy

In this section, we'll explain what blind XXE injection is and describe various techniques for finding and exploiting blind XXE vulnerabilities. What is ...

portswigger.net

Web Security Academy

@WebSecAcademy

5 years

We've added a huge new topic, on XXE (XML external entity) injection. Lots of new content and 9 new labs!

5

274

603

0

17

55

PortSwigger

@PortSwigger

3 years

Have you booked your Burp Suite Certified Practitioner exam yet? If you can complete all the "Apprentice" and "Practitioner" level labs in our Web Security Academy you're already well on your way … #burpsuitecertified

2

9

57

PortSwigger

@PortSwigger

2 years

😂

Jess

@D1AL__T0NE

2 years

All day Dark Mode then bam 💥 Burp Suite documentation @PortSwigger …

0

1

3

2

4

54

PortSwigger

@PortSwigger

3 years

Blog post: API scanning with Burp Suite. The web is increasingly reliant on APIs, and this post shows how Burp Suite's Scanner overcomes the problems of crawling them.

API Scanning with Burp Suite

How Burp Suite's Scanner overcomes the problems of crawling APIs

portswigger.net

0

16

54

PortSwigger

@PortSwigger

3 years

One more day to go folks - keep your eyes peeled tomorrow for our big announcement … #newproductlaunch #burpsuite #websecurityacademy

6

3

54

PortSwigger

@PortSwigger

2 years

Dastardly is a free, lightweight web application security scanner for your CI/CD pipeline. It looks at your application from the outside - just like an attacker - giving it the sort of accuracy that most static analysis tools can only dream of.

Dastardly, from Burp Suite

Dastardly, from Burp Suite is a free, lightweight web application security scanner for your CI/CD pipeline.

portswigger.net

0

15

54

PortSwigger

@PortSwigger

2 years

HTTP Request Smuggling was first documented in 2004 but largely forgotten until @PortSwiggerRes revisited it in 2019. Read up on the original research before @albinowax unveils the latest instalment, Browser-Powered Desync Attacks…

Upcoming Conference Talks - PortSwigger Research

portswigger.net

2

12

52

PortSwigger

@PortSwigger

3 years

Has everyone had their minds blown by the latest HTTP/2 research from @albinowax yet?

4

9

52

PortSwigger

@PortSwigger

4 years

Hackers unite in an amazing display of non-conformity, which is just what we like. No basement, no black hoodie. Just happy hackers. Share your pictures of #ThisIsWhatHackerLooksLike and let's all agree to not follow the herd!

4

9

52

PortSwigger

@PortSwigger

4 years

New PortSwigger merch store

8

11

50

PortSwigger

@PortSwigger

3 years

#newproductlaunch #burpsuite #websecurityacademy

1

5

49

PortSwigger

@PortSwigger

8 months

The Burp Suite Certified Practitioner exam is challenging - that means that not only is there no shame in failing, but you're likely to learn something from your failed attempts. Don't worry though; we can help you be better prepared for next time. 👇

Hints and guidance for retaking the Burp Suite Certified Practitioner exam | Web Security Academy

Get hints and guidance on becoming a Burp Suite Certified Practitioner, and some exam advice.

portswigger.net

0

14

51

PortSwigger

@PortSwigger

8 months

Anyone going to be attending Nullcon Goa on 23 September? If so, it's your last chance to catch the live presentation of @albinowax 's "Smashing the state machine: the true potential of web race conditions" … @nullcon #NullconGoa2023

Upcoming Conference Talks - PortSwigger Research

portswigger.net

1

9

49

PortSwigger

@PortSwigger

2 years

Blog post: A modern, elastic design for Burp Collaborator server

A modern, elastic design for Burp Collaborator server

When we launched Burp Collaborator back in 2015, PortSwigger deployed a public Collaborator server that anyone could use. This meant that OAST testing with Burp Collaborator was able to work straight

portswigger.net

0

10

49

PortSwigger

@PortSwigger

3 years

Did you know, DOM Invader can inject the canary into every source automatically? Set the canary to an injection and improve automated bug hunting - let DOM Invader do it for you!

1

8

49

PortSwigger

@PortSwigger

6 months

Been trying to find the best way to get started on the Web Security Academy? Introducing learning paths - a carefully curated, structured approach to develop knowledge and enhance skills.

New learning paths, from the Web Security Academy

When you're starting out in the world of web security, it can be overwhelming trying to work out where to begin. There are dozens of vulnerability classes, and numerous exploit techniques to learn abo

portswigger.net

4

8

48