Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Arman S. (Tess), a full-time independent security researcher and bug bounty hunter, talked us through how he uses Burp Suite Professional and HackerOne in tandem to find and report high-value security
First reported Sep 12, 2025 12:21 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordNote: This is a guest post by pentester Julen Garrido Estévez (@b3xal). 1. Acknowledgements 2. Intro 3. Required tools 4. Strategy to solve/exploit the lab 5. Detecting 0.CL 5.1. Practical confirmatio
First reported Mar 13, 2026 09:21 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe Hidden Threat That's Slipping Past Your Security HTTP request smuggling remains one of the most dangerous yet frequently overlooked web vulnerabilities today. Despite being a widely known issue si
First reported Aug 06, 2025 22:22 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordMore power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We’re excited to announce a new partnership with Meta
First reported Apr 07, 2026 12:12 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAt Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef
First reported Aug 06, 2025 22:23 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAI isn’t just reshaping cybersecurity - it’s challenging testers to rethink their entire playbook. In his latest article, “Hacking with Burp AI in the Chesspocalypse”, API expert Corey Ball draws less
First reported Nov 14, 2025 15:09 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn a brand-new collaboration between ethical hacking and AppSec expert John Hammond and world-renowned security researcher James Kettle, the pair explore how tens of millions of websites are compromis
First reported Aug 27, 2025 09:11 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record"It feels like I get 10X the productivity on an engagement. The difference is night and day." Profile Ray Huygen is a Security Analyst at Orange Cyberdefense, a managed security service provider with
First reported Aug 04, 2026 14:45 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordNote: This is a guest post by pentester and researcher, Tom Stacey (@t0xodile). You'd think that after almost 21 years since its initial public discovery, HTTP Request Smuggling would be barely exploi
First reported Sep 18, 2025 15:51 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordEvery December, TryHackMe’s Advent of Cyber brings the security community together around a simple idea: learn something new by getting hands-on. Each day during the festive season reveals a beginner-
First reported Dec 01, 2025 09:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAt Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef
First reported Aug 06, 2025 22:23 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAt Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef
First reported Aug 06, 2025 22:23 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordWhy we’re launching the program What it means to be a Burp Ambassador What we’re aiming for Our Burp Ambassadors Alan Levy Corey Ball Federico Dotta Rana Khalil Tib3rius Looking ahead Get Involved - B
First reported Apr 16, 2026 13:24 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThis week, we launched Burp AT in public beta for Burp Suite Professional users. Next week at Black Hat, PortSwigger Research will reveal more of the work that helped shape our direction. Burp AT is o
First reported Jul 30, 2026 14:58 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordBug bounty legend, NahamSec, has taken Burp AI for a spin. If you're curious how Burp AI fits into a real workflow, his new video is the perfect place to start. Watch on YouTube Burp AI was built to a
First reported Oct 01, 2025 14:31 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordNote: This is a guest post by IT security consultant Adarsh Kumar. I’ve been using Burp Suite day to day for years, so when Burp AI was introduced, I was curious how it would actually hold up dur
First reported Jan 22, 2026 15:18 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordEver wondered how attackers can compromise modern websites by exploiting invisible cracks in HTTP infrastructure to win big bounties? In his latest video, NahamSec walks through the basics of request
First reported Aug 05, 2025 11:08 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordDetecting React2Shell with Burp Suite Two new critical vulnerabilities, collectively known as React2Shell (CVE-2025-55182 and CVE-2025-66478), are rapidly gaining traction in the security community. D
First reported Dec 05, 2025 13:53 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn her latest video, CyberMaddy dives into the world of AI-driven ethical hacking, exploring how Burp AI performs in Repeater when tasked with finding web vulnerabilities like SQL injection, cross-sit
First reported Oct 22, 2025 13:15 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordShifting security left promises faster, safer software delivery - but for many teams, that promise is undercut by painful scan performance, false positives, and pipeline friction. In our recent webina
First reported Jul 14, 2025 13:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAppSec teams are under constant pressure to secure fast-moving applications without slowing anything down. But scanning windows, fragile authentication, and sprawling API estates often get in the way
First reported Dec 11, 2025 13:09 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordFirst hand of the week: Find us at BSides Workshop: Burp But Yours, with Hannah and Tib3rius Center stage: Visit us at Black Hat USA - Booth 5342 Lightning talks at the booth Catch our researchers' br
First reported Jul 09, 2026 09:20 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordBurp AT brings agentic AI to human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills. You decide how much work agents take on. Burp enforces the boundaries
First reported Jul 27, 2026 12:51 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAt PortSwigger, we’re always looking for ways to enable the world to secure the web, and today we’re excited to take that mission a step further. We’re pleased to announce a new collaboration bringing
First reported Mar 11, 2026 10:36 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.