How do I?

If you've got a general question about using Burp Suite, then this is the best place to ask.

View all

Feature Requests

Burp's pretty great already, but could we make it even better? Let us know.

View all

Burp Extensions

If your query involves a Burp Suite extension (BApp), then this is the forum for you.

View all

Bug Reports

Found a bug in Burp Suite? This is the place to let us know. Our devs will thank you.

View all

Latest posts

Bringing New Life to Burp Suite

Dear Portswigger Team, I hope this message finds you well! I wanted to make a humble request regarding Burp Suite 1.7.37. Although this version is a bit outdated now, it remains my (and many others') favorite...

Content-Length is update even "Update Content-Length" option is unchecked

In the repeater, Content-Length header is update even the "Update Content-Length" option is unchecked, I found this when I follow the lab "HTTP request smuggling". When check with the Logger show that Content-Length is...

How can I confirm the current users who assigned to my Burp Suite Professional Licenses?

I have two user-licenses of Burp Suite Professional. I have assigned a person to a license of Burp Suite Professional. Now I tried to assign a new person to the license. But I couldn't do with following...

Exploiting NoSQL operator injection to extract unknown fields -- What am I missing?

I found a hidden field and (after a lot of effort) extracted what would seem like a key value for said field... but for the life of me, can't figure out how on earth to use it... tried putting into header, cookie, using it...

Community version will not open the built-in browser

I have a VM with Linux distro on it and I installed Burp community and the first thing I did was select the open browser button from the proxy tab, it did not open. I then configured settings like my safari browser settings...

Lab "Clobbering DOM attributes to bypass HTML filters" is not getting solved

Below exploit is working for myself and getting the popup but when delivering this to victim then lab is not getting solved. Payload: <form id=x tabindex=1 onfocus=alert(1)><input...

LAB "Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped" is not getting marked as SOLVED

I am injecting below XSS payload and getting the popup with domain mentioned in it. https://0a36008e04cdc01a80cec72700990053.web-security-academy.net/?search=test%20${alert(document.domain)} Also, tried with...

Burp Suite Support Center

Your source for help and advice on all things Burp-related.

How do I?

Feature Requests

Burp Extensions

Bug Reports

Latest posts

Bringing New Life to Burp Suite

Content-Length is update even "Update Content-Length" option is unchecked

How can I confirm the current users who assigned to my Burp Suite Professional Licenses?

Exploiting NoSQL operator injection to extract unknown fields -- What am I missing?

Community version will not open the built-in browser

Lab "Clobbering DOM attributes to bypass HTML filters" is not getting solved

LAB "Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped" is not getting marked as SOLVED

Turbo Intruder Headless Error

Academy Progress Reset

Burp Suite Extension no longer supported by Chromium and is disabled

Burp Suite Support Center