A security researcher discovered that a common Burp Suite scope configuration unintentionally left third‑party requests visible, exposing an AI system's prompts and employee emails, which led to a $1,500 bug‑bounty after detailed analysis and remediation advice.
The article analyzes the opportunities and challenges of integrating large language models into penetration testing workflows, presents the design of the AI‑Burp‑Copilot plugin, details its layered architecture, implementation specifics, and real‑world limitations such as LLM nondeterminism and coverage of business‑logic flaws.
The article demonstrates a double‑layer MITM setup (mitmproxy → Burp Suite → mitmproxy) to decrypt SM2‑encrypted web request and response traffic, provides step‑by‑step commands, common pitfalls, and a GitHub skill that automates the process.
This article details step‑by‑step packet‑capture techniques using Fiddler, Burp and Clash, Google‑hacking for credentials, and then demonstrates extracting and abusing sensitive student data from a university WeChat mini‑program and its backend information system, including enumeration, XSS and data modification.
The article reviews two recent posts on AI‑assisted security testing, explains how Skills can limit large‑model performance, argues that MCP provides richer tooling, and shares a practical Burp MCP workflow with code snippets for traffic analysis in vulnerability research.
AuthKit is a Burp Suite extension that expands a single request into Original, Unauthorized and multiple‑role samples to uncover unauthorized access, horizontal and vertical privilege escalation, and BOLA issues, offering passive capture, right‑click active testing, multi‑identity replay, metric dashboards, diff views, context‑menu integration, and flexible scope controls.
The article walks through a security test of a WeChat public account that uses AES‑encrypted payloads, RSA‑encrypted keys, and an MD5 signature, showing how the author first tried memory editing with Cheat Engine, then succeeded by intercepting and modifying the JavaScript in Burp Suite to fix the key, and finally summarises why front‑end encryption can be bypassed.
XiaYue, a powerful Burp Suite extension, automates vertical and horizontal privilege escalation detection by comparing responses across multiple permission levels, offering smart deduplication, advanced filtering, parameter replacement, visual data tables, persistent configuration, and performance optimizations, while the author also shares a heartfelt story about their child's school start.
This article explores how large language models can be integrated with MCP Server and Burp Suite to automate web application vulnerability detection, detailing environment setup, workflow steps, code snippets, challenges such as token limits and payload formatting, and the advantages and limitations of the approach.
This article introduces seven leading penetration testing tools—including Kali Linux, Metasploit, Wireshark, Nmap, Burp Suite, Acunetix, and Nessus—detailing their primary features and how they help security professionals identify and mitigate vulnerabilities effectively.
This article provides a detailed, step‑by‑step tutorial for installing and activating Burp Suite Professional, covering file extraction, PowerShell script execution, license entry, manual activation, and final verification, complemented by screenshots for each major step.
This guide explains how to use Burp Suite's Auth Analyzer plugin to efficiently perform bulk API access‑control (broken access control) testing, covering vulnerability types, tool installation, step‑by‑step testing procedures, result analysis, and report export for improved software security.
This article explains how to employ Burp Suite to conduct comprehensive penetration testing on the ZhiXin mobile app, covering setup, proxy configuration, detection of sensitive data leaks, privilege escalation, XSS, and SQL injection vulnerabilities, and provides remediation recommendations.
