PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Refining your HTTP perspective, with bambdas

portswigger.net | research | #burp-suite | #graphql | #tooling | #bambdas | #http | #custom-columns
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bambdas power custom Burp columns that surface each message's essentials — GraphQL operation names, Referer, Server header, IP ownership via reverse DNS — with snippets from the research team.
Published
Collected

Related coverage

research · portswigger.net
Finding that one weird endpoint, with Bambdas
Bambdas find one weird endpoint in a 20GB project of website homepages: large redirect bodies, duplicate HTML tags and wrong Content-Length headers flagged real disclosures and source leaks.
blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
research · portswigger.net
Introducing HTTP Anomaly Rank
James Kettle introduces HTTP Anomaly Rank, an algorithm that surfaces the most interesting HTTP responses from huge result sets. It ships in Turbo Intruder and Burp Suite's 2025.10 API.
research · portswigger.net
Cracking the lens: targeting HTTP's hidden attack-surface
James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
Back