What's happening in the Burp-verse - Issue #10 📰

Hi 👋,

I hope you are doing well :)

If you got this newsletter for the first time, welcome onboard!!! Signing up for the newsletter was your first step in becoming the up-to-date hero of Burp Suite.

My dear comrades who have subscribed to this newsletter since the initial issues, I know you are thinking: Why was there a huge gap since the last newsletter issue?

Long story short - it started as a short break for a month, but that turned out to be a break for a few months 🤦‍♂️ along with a job change. 

As Steven Pressfield mentioned in his book The War of Art, resistance took over me. 

With love and support from fellow subscribers, I am back to the business and plan to send the newsletter issues regularly.

Follow Burp Suite Guide on Twitter and LinkedIn to get instant updates on Burp Suite. 

Now let’s continue.

My dear early adopters, this version has a couple of noticeable improvements:

Under the hood, Burp’s Scanner can now detect DOM-based vulnerabilities in scenarios where malicious input is only passed to a sink if an API call is made.

Also, there have been a few minor releases under 2022.3 with the following features:

When Burp Suite 2.0 was released, the crawler focused on tackling a newer breed of web applications - like single-page applications (SPAs) and apps built with client-side JS frameworks. This new breed depended upon the “state” (like the user adding something to the cart).

When we crawl static sites (even with the fastest crawl strategy), the crawler, assuming the web app to be stateful, will take time to get the maximum coverage. The time taken could be much shorter. 

So in Burp Suite 2022.2.3, the “fastest” crawl strategy doesn’t consider the state and completes crawling 6x - 9x faster. 🔥

Check out the article.

This article by Pentagrid shows how they enhanced Burp Suite with the help of extensions to test their customized target application. Their target web/thick client application seems to have encrypted the requests and compressed them before sending. The server did the same with responses.

Have you ever faced a similar situation before?

This article shows how they solved this custom Transport Encoding problem (along with a Burp Suite extension template). Check it out.

This extension decodes easy CAPTCHA challenges (like four alphanumeric characters) using the ddddocr project. The best part is that the decoding happens locally on your system. The author says this decoding had 85% accuracy. This forked project also adds improvements over the original extension.

This extension might be for you if you use Nuclei and have already integrated it into your bug bounty recon workflow. 

You can manually test your bug bounty targets for bugs as usual. Did you find any interesting endpoints or responses? Then, you can use this extension to generate a nuclei template and run the same template across all your targets to find the same bug.

This extension integrates the Burp Suite’s request logging with a custom application testing checklist. It helps pentesters who want to keep track of all web app functionalities, API endpoints, and vulnerability types tested.

Did you learn something new from this newsletter? 🥺

Please share this newsletter with your friends, hackers & pentesters. Tweet about it, post it on social media, or forward this newsletter email to others.

If you liked the newsletter, click the 👍 button below. If you have any specific feedback, shoot an email to [email protected].

Many thanks for considering my request.

Until next time 👋