PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp v1.4 preview - Session handling

portswigger.net | blog | #burp-suite | #automation | #session-handling | #preview | #cookie-jar | #csrf-tokens
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Burp v1.4's session handling features tackle scanning obstacles such as terminated sessions, rotating anti-CSRF tokens, and multi-request setup, with a shared cookie jar across all tools.
Published
Collected

Related coverage

blog · portswigger.net
Burp v1.4 preview - Session handling: putting it all together
A worked example shows how Burp v1.4 session handling rules combine session validation, automatic re-login, and anti-CSRF token fetching to keep automated testing running unattended.
blog · portswigger.net
Burp v1.4 preview - Macros
Burp v1.4 macros let users record request sequences for session handling rules, covering session checks, re-login, token retrieval, and multi-step process setup before fuzzing a request.
blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
Back