As you may know, I've been giving Burp Suite Pro trainings for the last 10 years And this year, I'll give a single public on-site Burp Suite Pro training session, and it will be in RomHack 🇮🇹 (registration link in replies)

Somebody asked me how to extract URLs from the Site Map without using the clipboard. So I wrote the following bambda ⤵️

In case you want to nominate an extension (or several) for the 2026 Burp Suite Extension Awards... docs.google.com/forms/d/e/1F...

2026 Burp Suite Extension Awards

Nominate a Burp Suite extension you love Which Burp Suite extension has made your work easier, faster, or just a bit more enjoyable? Nominate it for the 2026 Burp Suite Extension Awards and tell us w...

docs.google.com

Great news: Burp's notes now support Markdown 🥳 🎉 It works in the usual notes (as the exchange level) but also in the About tab of collections (except for the default one named "Inbox")

Great news: Burp's notes now support Markdown 🥳 🎉 It works in the usual notes (as the exchange level) but also in the About tab of collections (except for the default one named "Inbox")

Just discovered the "Find tag" functionnality of Hackvertor and I already find it very useful 🔥 It can be triggered from Burp's command palette or with the Ctrl-Alt-F keyboard shortcut 🐇

Gareth Heyes@garethheyes.co.uk · 9mo ago

Just released a major update to Hackvertor: History logging: your conversions are now replayable and stored in the project file. Tag-Finder window (props to @CoreyD97): filter and insert tags from within the UI. CTRL+ALT+F Lastly: Tab persistence thespanner.co.uk/hackvertor-h...

Last week, Syzik took my course and patched JWT ReAuth as the same time 🤯 Here's his fork github.com/Syzik/jwt-re... This version supports multiple profiles, per profile scopes, and the ability to fetch access tokens from refresh ones 🛠️

GitHub - Syzik/jwt-reauth

Contribute to Syzik/jwt-reauth development by creating an account on GitHub.

github.com

A nice trick by @parsiya.bsky.social: how to share a Burp project with others without sharing tokens and secrets 🧠 parsiya.io/research/bur...

Come to Roma 🇮🇹 in September and attend the only in-person public training session I'll give in 2026! 👨‍🏫 And if you like camping with other hackers (as I do), stay over the weekend for the 3-day long RomHack Camp 🏕️ romhack.io/training/

Since EA 2026.2, there's a a search bar in Proxy History and it doesn't work exactly like the usual display filter. Let me explain... - the filter searches in requests, responses and notes - the search bar looks for the keyword in the table of entries itself (including custom and/or hidden columns)

Out of curiosity, I counted how many configurable hotkeys exist in Burp Pro 📏 In Early Adopter version 2026.1.1, the answer is 168 🤓

a man is typing on a keyboard in a living room

Alt: A guy typing very fast on a keyboard

media.tenor.com

A bunch of new features in EA 2025.12, including an E2E-encrypted way to share traffic between Pro users portswigger.net/burp/release...

Professional / Community 2025.12

This release adds collections for secure message sharing, quick URL actions in command palette, OAuth2 Client Credentials support for API scanning, and improvements to Comparer and extension hotkeys,

portswigger.net

I really have to try this new MultiEncoder 🔬

Gareth Heyes@garethheyes.co.uk · 8mo ago

Hackvertor 2.2.33 released! - New MultiEncoder window (CTRL+ALT+M) for applying multiple transformations across layers and sending to Repeater tab - WebSockets support including a WebSocket handler and a new WebSocket setting - Improved auto decoding

Burp Hackvertor has a bunch of new shortcuts and functionality. Try them out in Burp. They are activated from a Burp repeater request.

The 2026 online public sessions of my "Mastering Burp Suite Pro" course have been published 📅 - March 24th to 27th, in French 🇫🇷 - April 14th to 17th, in English 🇬🇧 hackademy.agarri.fr/2026 PS: feel free to ping me if you'd like to temporarily block a seat or are looking for a 10% coupon 🎁

Agarri

Training

hackademy.agarri.fr

Burp now has a command palette (similar to the one in VS Code) 🥳 portswigger.net/cms/images/4...

Coming to Hackvertor soon... Big thanks to CoreyD97 for the suggestion!

Burp now has a command palette (similar to the one in VS Code) 🥳 portswigger.net/cms/images/4...

I've just upgraded Turbo Intruder with a shiny new algorithm called HTTP Anomaly Rank, which automatically finds the most unusual responses in your attack! Here's a quick demo, full details in the writeup below: youtu.be/z92GobdN40Y

HTTP Anomaly Rank - a new Turbo Intruder feature

YouTube video by PortSwigger

youtu.be

Portswigger changed the way the Scanner configuration looks like (at least in Early Adopter releases) and I really like the new layout 👏

If you're looking for a quick tool to copy regex matches from requests AND responses, have a look at github.com/honoki/burp-...

GitHub - honoki/burp-copy-regex-matches: Burp Suite plugin to copy regex matches from selected requests and/or responses to the clipboard.

Burp Suite plugin to copy regex matches from selected requests and/or responses to the clipboard. - honoki/burp-copy-regex-matches

github.com

I wrote a small utility to copy unique domains, URLs, paths, filenames or directories from a selection on the Target Map in Burp Suite. The directories is especially useful in combination with something like ffuf, e.g. for /path/to/folder/file.txt will return the list /path /path/to /path/to/folder

GitHub - honoki/burp-copy-unique-domains

Contribute to honoki/burp-copy-unique-domains development by creating an account on GitHub.

github.com

Great news! When creating a scan configuration, all non-default settings are now saved 💾 The ugly UX where only opened panes were saved is gone (since at least EA 2025.9.1) 🗑️

A few days ago, @tib3rius.bsky.social published a video where he uses Burp AI features to hack on a vibe-coded web app 🪄 www.youtube.com/watch?v=lHby...

Hacking a Vibe Coded App with Burp AI!

YouTube video by Tib3rius

youtube.com

New video, Decrypting TLS traffic in Wireshark. How to extract TLS keys from Burp, ZAP, and curl and then import them into Wireshark to see the raw traffic. youtu.be/bSt6E48mGuc

If you're confused by the amount of resources stored in the JAR, here's a hint 🔎 Check out "resources/Scanner/jwt_secrets.txt". It contains over 100k passwords used by the passive scanner to decrypt JWT tokens 🗝️ And it works: that's how @evilpacket.net scored a $1500 bug affecting Cursor 💰

Adam Baldwin@evilpacket.net · last yr.

The finding was for "JWT weak HMAC secret" and it said the secret was literal "secret" A range of emotions pushed me in various directions at once. What? no.!? yes!!!!!!! let's verify...

In case you missed it, AWS updated its policy about pentesting, and "Amazon API Gateway" (used by the extension "IP Rotate") isn't allowed anymore aws.amazon.com/fr/security/...

Hackvertor v2.1.25 has been released and fixes the content-length problem!

Hackvertor v2.1.24 has a major bug where it doesn't update the content-length. Sorry about that. I've fixed it in v2.1.25. I'll try and get it updated on the BApp store ASAP. Gutted I missed this, sorry I'll try to do better in future.