How do I?

If you've got a general question about using Burp Suite, then this is the best place to ask.

View all

Feature Requests

Burp's pretty great already, but could we make it even better? Let us know.

View all

Burp Extensions

If your query involves a Burp Suite extension (BApp), then this is the forum for you.

View all

Bug Reports

Found a bug in Burp Suite? This is the place to let us know. Our devs will thank you.

View all

Latest posts

Copy Generated Payloads Button within Intruder

It would be nice to be able to copy randomly generated numbers from the initial payload setup screen within intruder. So that we can we use the payloads elsewhere if needed, outside of Burp.

Burp2 URL exclusion for scan, but not for session

For Burp2 and Burp EE - how do I exclude the URL for scanning, but not for crawling part? That is, the login is taken care of by 3rd party authentication mechanism located in external domain. Example: Test scope URL:...

Can We Implement a "Create New Group" API to the Montoya API?

Hi there! I'm currently working on a Burp extension that uses the Montoya API. I need to send multiple HTTP requests to the Burp Repeater, and it would be great if I could create a new tab group using the Montoya API....

BApp store not loaded in extensions section

Hi Team, I'm using burp professional v2024.8. I'm not able to see any burp extensions in BApp store. I tried refreshed list and manual install but it's not working. BApp store section is empty. When I click on refresh...

not getting expected responses

i am doing brute force labs but i am not receiving expected response from last 2 or 3 labs currently i am doing " Password brute-force via password change " this lab and Sec-Fetch-Site: same-origin Sec-Fetch-Mode:...

Request to Delete My Account

I hope this message finds you well. I am writing to request the deletion of my account associated with the email address [your email address]. Please confirm the account deletion process and let me know if you need any...

Return 500 during intruder attack with Lab: Exploiting NoSQL operator injection to extract unknown fields

Hello, When doing this lab : https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-extract-unknown-fields The intruder attack return error 500 for each request with this payload...

Lab: HTTP request smuggling, basic TE.CL vulnerability

I am running through the labs again in prep to take the test. I think this lab has stopped working. Regardless of what I do, it does not seem like the backend is honoring the Content-Length header. I've tried multiple...

Burp possibly doesn't close HTTP2 gRPC connection gracefully

First of all, thank you for your great efforts to make HTTP2 available in Burp. I'm using Go gRPC example application named RouteGuide(https://github.com/grpc/grpc-go/tree/master/examples/route_guide) to check Burp can...

Zscaler blocking the burp suite interactions

Hi Team, We are facing the issue that Zscaler is blocking the burp suite interactions like being unable to add extensions and use collaborators. On troubleshooting this issue we observe this seems to be an SSL issue, Burp...

Burp Suite Support Center

Your source for help and advice on all things Burp-related.