How do I?

If you've got a general question about using Burp Suite, then this is the best place to ask.

View all

Feature Requests

Burp's pretty great already, but could we make it even better? Let us know.

View all

Burp Extensions

If your query involves a Burp Suite extension (BApp), then this is the forum for you.

View all

Bug Reports

Found a bug in Burp Suite? This is the place to let us know. Our devs will thank you.

View all

Latest posts

Ranking on WorldWide #178

Hi Team, I’m currently ranked #178 worldwide on the PortSwigger Hall of Fame, and I'd love to share this achievement on social media. However, I can't see my name on the list, as it only displays the top 50 individuals....

Lab: Reflected XSS protected by very strict CSP, with dangling markup attack

I can't complete the lab. After I "Deliver the exploit" to victim, I get nothing in the Collaborator. No response at all. I follow everything it says in the solution, I tried several videos with people doing it, but nothing...

how to slove this problam

This is your server. You can use the form below to save an exploit, and send it to the victim. Please note that the victim uses Google Chrome. When you test your exploit against yourself, we recommend using Burp's Browser...

There's something wrong with lab "Targeted web cache poisoning using an unknown header"

Hello, Multiple times I've tried to complete this but it breaks. Sometimes when I try to open this lab, I get a 504 error saying no response. When I do get in, when I get to the step to add "X-Host: example.com", when I...

Possible error in 'Lab: Basic clickjacking with CSRF token protection'

Despite I inputted the URL of the account page of the dangerous delete button, the log in page is displayed in the exploit server instead of the page containing the dangerous delete button

CSRF where token validation depends on request method

Hi, I have a problem with solving CSRF where token validation depends on request method in Burp professional version. This is my code from exploit server aned I have changed email in the code.Do you have more information...

CSRF Labs Broken?

Hi, Is it possible the CSRF labs are broken? I have attempted the following: - https://portswigger.net/web-security/csrf/lab-no-defenses -...

intercept on/off button duplicated next to settings wheel

The proxy intercept switch is a core feature of burp and it's kinda buried in the UI. It's hard to even get a "muscle memory" for it because when you turn it off the view changes to the blank screen with the binoculars or...

Perform Active Scan With Checksum

Hello, I am working with an API that uses a checksum calculated based on all the parameters and values in the request. How can I run an active scan on this API? Is there a way to run a script before or after the request,...

Basic questions about the exam

Hi, If I fail the exam, do I have to pay the fee again in order to take another attempt ? Also, how frequently are exams held, and how long in advance should I register ? Best regards, sssss

Burp Suite Support Center

Your source for help and advice on all things Burp-related.