PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp Suite tips from power user and "hackfluencer" Stök

portswigger.net | blog | #bug-bounty | #burp-suite | #interview | #intruder | #tips | #youtube
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

YouTuber and long-time Burp Suite fan Stök shares how he got into web security and offers practical tips for beginners, from mastering the basics to using Intruder and Repeater effectively.
Published
Collected

Related coverage

blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A case study of Burp AT analyzing 66,000 lines of minified JavaScript on a timeboxed engagement, uncovering a path to leak confidential whistleblower reports protected only by brute-forceable codes.
blog · portswigger.net
From capable AI models to trusted security testing
PortSwigger explains the thinking behind Burp AT: agentic capability is useful only when control sits outside the model, scope is enforceable, and agent activity is recorded as evidence.
blog · portswigger.net
Introducing Burp AT: agentic AI, built on two decades of Burp Suite
PortSwigger launches Burp AT (public beta) for Burp Suite Professional: agentic AI inside Burp using its tools, project context and pentesting skills, with user-defined autonomy.
Back