PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp gets new JavaScript analysis capabilities

portswigger.net | blog | #burp-suite | #dom-xss | #javascript | #scanner | #static-analysis | #websocket-hijacking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Burp adds a static JavaScript analysis engine enabling the Scanner to report DOM XSS, WebSocket hijacking, client-side SQL injection, and other DOM-based issues, initially released as experimental.
Published
Collected

Related coverage

tool · github.com
Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript
Streamlines JavaScript reconnaissance during bug bounty hunting and web penetration testing by uncovering hidden attack surfaces and exposed secrets with minimal noise.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Dynamic analysis of JavaScript
Burp's new scanner adds dynamic JavaScript analysis via an embedded headless browser, injecting payloads into the DOM and monitoring sinks to reliably uncover DOM-based vulnerabilities.
vulnerability · portswigger.net
Backslash Powered Scanning: hunting unknown vulnerability classes
James Kettle presents backslash-powered scanning: an approach that finds known and unknown classes of server-side injection flaws with a tiny network footprint, tested across thousands of sites.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
research · portswigger.net
Burp Clickbandit: A JavaScript based clickjacking PoC generator
PortSwigger releases Burp Clickbandit, a pure-JavaScript point-and-click tool that generates clickjacking proof-of-concept attacks, including multi-click attacks, directly from within Burp.
Back