PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dynamic analysis of JavaScript

portswigger.net | blog | #burp-suite | #dom-xss | #javascript | #scanner | #mobp | #dynamic-analysis | #headless-browser
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Burp's new scanner adds dynamic JavaScript analysis via an embedded headless browser, injecting payloads into the DOM and monitoring sinks to reliably uncover DOM-based vulnerabilities.
Published
Collected

Related coverage

blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Launching scans
Burp's new scan launcher unifies crawling and auditing into one scan concept, letting users combine configuration presets, login credentials, and resource pools for each scan.
blog · portswigger.net
The new configuration library
With parallel scans each needing their own settings, Burp introduces a configuration library that stores built-in and user-defined configurations, importable and exportable as JSON for sharing.
blog · portswigger.net
Improved management of system resources
Burp's new task execution engine centrally manages CPU and network resources across tasks, with configurable resource pools, dynamic thread sizing, and steadier behavior under low memory.
blog · portswigger.net
Multiple parallel scans
Burp will replace its singleton Spider and Scanner tools with multiple parallel scans, each having its own configuration, scope, and queue, controllable and prioritizable independently.
blog · portswigger.net
Handling application errors during scans
Burp's new scanner tracks scan errors granularly, retries failed operations in follow-up passes after each phase, and can optionally pause the whole scan when an application appears to be down.
Back