I'm sure you'll agree that it's pretty shocking, and it works in every browser. It's also a pretty nice way to bypass a WAF. Let's continue the journey. If localName returns a lowercase version of the ...

We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genuinely new attack techniques? To ...

Webmail has been around for decades and it's always had to solve a very difficult problem of taking untrusted HTML and displaying it to the user in a safe way. This is made even more challenging by ...

Burp AT brings agentic AI to human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills. You decide how much work agents take on. Burp enforces the boundaries ...

This release introduces Burp AT, an agentic AI-driven capability for Burp Suite Professional that pursues the testing goals you set using Burp's own tools. Burp AT enables you to embrace agentic AI ...

Throughout May 2026 we ran Extensibility Month on the PortSwigger Discord server - a full month of talks, workshops, community sessions, and the Burp Extension Awards, decided by community vote. The ...

This release updates the bundled Java runtime to Java 26. It also includes improvements to Burp Scanner and a range of bug fixes.

Today, we are delighted to launch our official Burp Ambassador Program: a community initiative to collaborate more closely with experienced Burp users, and support the great work they’re already doing ...

This release introduces the Discover tab, faster table navigation with command palette, smarter SQLi detection, SPNEGO support for NTLM, plus other improvements, a Java update, and a browser upgrade.

This release adds collections for secure message sharing, quick URL actions in command palette, OAuth2 Client Credentials support for API scanning, and improvements to Comparer and extension hotkeys, ...

This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusion, ...

Postman Collection Importer converts Postman collections and environments into Repeater tabs and Sitemap entries. The extension supports variable resolution, authentication methods, and multiple ...