SIGN IN YOUR ACCOUNT TO HAVE ACCESS TO DIFFERENT FEATURES

FORGOT YOUR PASSWORD?

FORGOT YOUR DETAILS?

AAH, WAIT, I REMEMBER NOW!
Need Help? Email [email protected]
  • LOGIN

E-SPIN Group

CONTACT US / GET A QUOTE
  • No products in cart.
  • HOME
  • PROFILE
    • Corporate Profile
    • About us
    • Customer Overview
    • Case Studies
    • Investor Relations
    • Procurement
  • GLOBAL THEMES
    • Artificial Intelligence (AI)
    • Big Data
    • Blockchain
    • Cloud Computing
    • Cognitive Computing
    • Cyber Security
    • DevSecOps
    • Digital Transformation (DT)
    • Modern Workplace
    • Internet of Things (IoT)
    • Quantum Computing
    • More theme and feature topics
  • SOLUTIONS
    • Application Lifecycle Management (ALM), DevSecOps/VSM, Application Security
      • Application Security
      • DevSecOps
      • Digital Forensics
      • Secure Development
    • Cybersecurity, Governance Risk Compliance (GRC) and Resiliency
      • Governance, Risk Management and Compliance (GRC)
      • Malware Analysis and Reverse Engineering
      • Security Information & Event Management (SIEM)
      • Security Configuration Management (SCM)
      • Threat and Vulnerability Management
      • Penetration Testing and Ethical Hacking
    • Modern Infrastructure, NetOps
      • Network Performance Monitoring and Diagnostics (NPMD)
      • IT Operations Management (ITOM)
      • Network Operation (NetOps)
      • Network Management System (NMS)
    • Modern Workspace & Future of Work
      • Digital Workspace
      • End User Computing (EUC)
      • Securing Hybrid Workforce
      • Unified Endpoint Management (UEM)
      • User Activity Monitoring (UAM)
  • INDUSTRIES
    • Aerospace & Defense
    • Automotive
    • Banking & Financial Markets
    • Chemical & Petroleum
    • Commercial and Professional Services
    • Construction & Real Estate
    • Consumer Products
    • Education
    • Electronics
    • Energy & Utilities
    • Food & Beverage
    • Information Technology
    • Insurance
    • Healthcare
    • Goverment
    • Telecommunications
    • Transportation
    • Travel
    • Manufacturing
    • Media & Entertainment
    • Mining & Natural Resources
    • Life Sciences
    • Retail
  • PRODUCTS
    • Hidden Menu
      • Brand Overview
      • Services Overview
      • E-SPIN Product Line Card
      • E-SPIN Ecosystem World Solution Portfolio Overview
      • GitLab (DevOps, DevSecOps, VSM)
      • Hex-Rays (IDA Pro, Hex-Rays Decompiler)
      • Immunity (Canvas, Silica, Innuendo)
      • Parasoft (automated software testing, AppSec)
      • Tenable (Enterprise Vulnerability Management)
      • Veracode (Application Security Testing)
    • Cybersecurity, App Lifecycle, AppSec Management
      • Cerbero Labs (Cerbero Suite)
      • Core Security (Core Impact, Cobalt Strike)
      • HCL (AppScan, BigFix)
      • Invicti (Acunetix, Netsparker)
      • ImmuniWeb
      • UBsecure (Vex)
      • Portswigger (Burp Suite Pro, Burp Suite Enterprise)
      • Titania (Nipper Studio)
      • TSFactory (User Activity Monitoring)
    • Infrastructure, Network, Wireless, Cloud Management
      • Metageek (Wi-Spy, Chanalyzer, Eye P.A.)
      • Progress (WhatsUp Gold, WS_FTP, MOVEit MFT)
      • Paessler
      • Solarwinds (IT Management)
      • TamoSoft (wireless site survey)
      • Visiwave (wireless site survey, traffic analysis)
      • VMware (Virtualization, cloud mgt, Digital Workspace)
    • Platform products
      • Adobe (Digital Media Creation)
      • Micro Focus
      • Microsoft
      • Red Hat (Enterprise Linux, OpenStack, OpenShift, Ansible,JBoss)
      • SecHard
      • SUSE (Enterprise Linux, Rancher)
      • Show All The Brands and Products (Full)
  • e-STORE
    • e-STORE
    • eSTORE Guide
    • SUPPORT
  • CAREERS
    • Culture, Values and CSR
    • How We Hire
    • Job Openings
  • BLOG / NEWS
    • Blogs and News
    • Resources Library
    • Calendar of Events
  • CONTACT
  • Home
  • Brand
  • Burp Suite Enterprise Edition Product Latest Release and Build
0
E-SPIN
Friday, 01 July 2022 / Published in Brand, PortSwigger

Burp Suite Enterprise Edition Product Latest Release and Build

Burp Suite Enterprise Edition Product Latest Release and Build, this is an ongoing and incremental update post, we consolidate all information into a single post for users who want to know all the updates, new features and fixes along the edition.

Latest release and build will show at the top of the post, and the oldest information will at bottom. If you are looking for the Burp Suite Enterprise Edition product information like features and benefits, please read it from this dedicated post link https://www.e-spincorp.com/burp-suite-enterprise-edition/


Enterprise Edition 2022.6 Release 2022-Jul-1

This release offers preset scan modes that make it easily to start scans for a range of use cases as well as simpler way to monitor how your scans are progressing .

Simplified scanning with preset scan modes

Start scanning easily with the new preset scan modes. These four ready-to-use modes allows you to adjust the balance of speed and coverage using a single click, thus quickly launch a scan based on your needs. Moreover, you can choose from Lightweight, Fast, Balanced, or Deep modes when creating or editing a site.

Create custom scan configurations to fine-tune Burp Scanner‘s behavior is still available. You just need to select the Use a custom configuration radio button to access every options you’re familiar with from the previous versions.

Improved scan duration estimates

Improved scan durations estimaties let you to easily monitor how your scans are progressing through:

  • An indication of the time remaining for all scans, including new scans.
  • Improved the accuracy of duration estimates for recurring scans, by considering historical scan durations.
  • Able to view if the scan is in the ‘crawling’ or ‘auditing’ phase.

Other improvements

This release also includes the following improvement:

  • When you use the ‘Scan again’ function, you can decide to enable verbose logging which is helpful in troubleshooting.

Bug fixes

Some bugs fixes such as:

  • No more duplicates if you use the GraphQL API to get issues one at a time.
  • Fixed an error when running a recovery or upgrade installation.
  • Filter will no longer reset if you set a filter in the Issues tab and then click on an issue in the sidebar.

Enterprise Edition 2022.5 Release 2022-Jun-6

This release lets you raise tickets for multiple issues at once and gives a security patch. Additionally, manage scan configurations has also been simplified.

Raise tickets for multiple issues

Raising tickets for multiple issues at the same time in Jira, GitLab and Trello are now possible. This feature allows you to create a separate ticket for each issue, or combine similar type of issues into one ticket.

Changes to how scan configurations are managed

Manage scan configurations is now enabled exclusively on the site level. You are now unable to override the site’s configuration when scheduling a scan. This simplifies the process and ensures accuracy on the data used to track your security posture.

Other improvements

This release also offers other improvements such as:

  • Enable verbose debugging using users running scans in the cloud, allowing more detailed logs to be sent to the PortSwigger support team.
  • Scan reports include reasons for scan failures.
  • Clean up of the old version scanner after seven days helps reduce the need to manage disk space. However the latest version is not deleted.
  • JRE upgraded to version 11.0.15 which provides several security patches.

Security patch

We have fixed a bug related to site restrictions which is identified during internal testing.

Bug fixes

Some bug fixes that come with this release includes:

  • Able to change the web server port when using an HTTP web server configuration.
  • Able to delete sites if you’re running an SQL server.
  • Users with the ‘Scan initiator’ role can use the Scan again button.
  • Able to select sites in nested folders in the scanning pool.

Enterprise Edition 2022.4 Release 2022-May-6

This release enables several new reporting formats associated to PCI DSS and OWASP Top 10 vulnerabilities, also automated ticket creation for GitLab and Trello.

Compliance reporting

This Burp Suite Enterprise Edition which includes compliance reporting formats directly relating to the PCI DSS and the OWASP Top 10 makes it much easier to check for relevant vulnerabilities across your whole web portfolio.

Automated ticket creation for GitLab and Trello

Solving issues in Burp Suite Enterprise Edition is now easier as it can automatically create GitLab tickets and Trello cards when issues which are above a specified severity and confidence level found during scans.

Minor improvements and bug fixes

This release includes a number of minor improvements and bug fixes, such as

  • Added support for MariaDB 10.6.
  • Fixed an issue related to Trello cards were being raised with visible HTML tags included in the content.
  • Fixed an issue for the occasional web server failure in generating a self-signed certificate when installing using an external database.

Enterprise Edition 2022.3 Release 2022-Apr-5

Deploy to any Kubernetes cluster using our new Helm chart

This release let you deploy Burp Suite Enterprise Edition to any Kubernetes cluster that meets several simple prerequisites, using a Helm chart.

As a results, you can apply auto-scaling of scanning resources, which able to reduce infrastructure costs and maintenance effort – most importantly for larger deployments. Moreover, it is easier to run Burp Suite Enterprise Edition on your existing Kubernetes infrastructure.

For information on how to deploy Burp Suite Enterprise Edition to Kubernetes, refer the documentation.

Migrating from an existing cloud deployment

The new Kubernetes deployment option now replaces the existing AWS and Azure cloud deployment templates.

While deployments built using our AWS and Azure templates will still be available for the immediate future, it is highly recommended to migrate to the new infrastructure when possible. In future, Burp Suite Enterprise Edition will no longer support legacy cloud deployments.

Refer the documentation for migration details.

Simplified terminology

Terminology of some components of Burp Suite Enterprise Edition are now using more descriptive names.

Significantly, this release no longer refer to “agents” as the word “agent” was used both internally and among users to mean different things depending on context. For instance, both the logical entity that performs scans and the machine on which the scan runs on were sometimes both referred to as an agent.

Now, the machine that runs scans is known as a “scanning machine”. Other than that, we now talk about the number of “concurrent scans” covered by your license, rather than a number of agents.

Minor improvements and bug fixes

This release involves several minor improvements  which include:

  • Fixed an issue that was preventing quick scans from running on the Site page.
  • Corrected the site tree navigation so that any expanded folders remain expanded if you select a site outside of that folder.
  • Officially ended support for Internet Explorer 11.
  • All sites created using the CSV bulk upload feature have a default scope protocol of Scan using HTTP & HTTPS. The same default scope protocol applies when creating sites manually in the UI.

Enterprise Edition 2022.2.1 Release 2022-Mar-3

This release provides a number of minor improvements and bug fixes. For example:

  • When you run a scan with verbose logging enabled, you can now download the scan’s project file for debugging purposes.
  • We have fixed a bug that was preventing email notifications for new updates from being sent to customers who are running the 2022.2 release.

Enterprise Edition Jenkins plugin 2022.2 Release 2022-Mar-1

This release fixes the Jenkins plugin. The previous version was causing the Burp Suite Enterprise Edition UI to become non-functional when used in combination with the kubernetes-cli plugin. This was due to a jQuery conflict.


Enterprise Edition 2022.2 Release 2022-Feb-23

This release provides a number of minor improvements and bug fixes. For example:

  • We have fixed a bug that was preventing the database server from shutting down during Enterprise server updates. This was causing version mismatches between the two servers.
  • We have amended the Jira settings UI page so that it is consistent with the existing Trello and Gitlab settings pages.
  • We have made performance improvements to the site tree. Previously, the UI could become unresponsive when importing or performing bulk actions on large numbers of sites.

Enterprise Edition 2022.1.1 Release 2022-Feb-21

This release does not provide any additional functionality. It simply implements some background changes in preparation for a future release, which will enable a brand new option for deploying to Kubernetes using a Helm chart. This will replace our existing AWS CloudFormation and Azure Resource Manager deployment methods.

Please note that if you deployed Burp Suite Enterprise Edition using our existing AWS CloudFormation or Azure Resource Manager templates, this is the last version that those deployments will support. You will need to migrate using the new Helm chart (coming soon) before you can install any future updates.


Enterprise Edition 2022.1 Release 2022-Jan-21

This release offers a number of minor improvements and bug fixes such as:

  • You are now given alert through the scan log when the assigned agent machine has insufficient resources available to run a scan in order to prevent overloading machines with too many concurrent scans that can lead to poor performance or cause scans to fail.
  • You are provided with bug fix that prevent bulk site imports from a CSV file working as expected.
  • You are provided with bug fix that prevent from applying self-signed certificates for connecting to an SMTP server using TLS.

Enterprise Edition 2021.12.1 Release 2021-Dec-15

This release came with the audited version of both Burp Suite Enterprise Edition and Burp Suite Professional/Community Edition. The release focuses on making sure that both versions are not vulnerable to the latest discovery on vulnerability in the Java logging library Log4j. Even though this library was present in Burp Suite Enterprise Edition because of transitive dependency, it was not used.

Importantly, you should disable third-party extensions while they are audited as they may appear vulnerable.

Jira bug fix

This release includes bug fixes that disable you to create Jira tickets from Burp Suite Enterprise Edition.

Cloud deployment links

AWS CloudFormation or Azure Resource Manager templates will be replaced with the release of a more improved, simpler deployment method soon. It is recommended to wait for the release instead.


Enterprise Edition 2021.12 Release 2021-Dec-15

This release allows bulk actions for sites and scans as well as integration with GitLab and Trello which enable you to raise tickets for any vulnerabilities detected by your scans.

Bulk actions for sites and scans

Now, you are able to perform common actions on multiple items at the same time from the Sites and Scans pages which includes:

  • Moving sites and folders
  • Deleting sites and folders
  • Launching quick scans
  • Cancelling or deleting scans

The bulk actions menu which appears automatically during selection of one or more items using the checkboxes to the left of the page. helps you save significant amount of time and effort particularly when managing your site tree.

Trello and GitLab integration

Connecting to Burp Suite Enterprise Edition to both Trello and GitLab are now available. Therefore, for any vulnerabilities detected  by your scans, you can create Trello cards or raise GitLab issues from the Burp Suite Enterprise Edition web UI.

Refer to the documentation for information on how to configure the integration.

Microsoft SQL Server 2019 support

Microsoft SQL Server 2019 databases  is available to use with Burp Suite Enterprise Edition.  Refer to the documentation for a complete list of supported database types.

GraphQL upgrade

GraphQL implementation to GraphQL Java 17.3 have been updated in this release to improve bug fixes and also increase protection against denial-of-service attacks.

Verbose scan log

This release gives you the option to enable verbose logging when creating a one-off scan. This can be done by downloading this log from the Reporting & Logs tab.

Importantly, this feature is specifically design for technical support team (This team will occasionally ask you to activate this when helping you resolve a problem.

Bug fixes

This release consists of several minor bug fixes. The most notable bug fixes feature that have been added are  improved uninstallerthat allow you to lower the chance of issues arising when reinstalling at a later date as well as an issue that may occur when running the database transfer tool with MySQL 8 databases.

Cloud deployment links

AWS CloudFormation or Azure Resource Manager templates will be replaced with the release of a more improved, simpler deployment method soon.


Enterprise Edition 2021.11 Release 2021-Nov-11

This release provides a new option for preconfiguring and adding a large number of sites in bulk, adds support for Slack integration, and enables user provisioning and decommissioning via SCIM. It also contains a number of minor improvements and bug fixes.

Add multiple sites in bulk

Instead of adding and configuring sites in Burp Suite Enterprise Edition one by one, you can now preconfigure and import a large number of sites at once from a CSV file.

You can download our template from the Sites page by clicking Import Sites.

For more information, please refer to the documentation.

Receive automated scan notifications via Slack

You can now connect Burp Suite Enterprise Edition to Slack. Once configured, this enables you to automatically notify teams via their Slack channels whenever a scan starts, fails, or finishes for a given site.

As you assign Slack channels on a site-by-site basis, you can ensure that channels only receive notifications about sites that are relevant to them.

For details on how to configure the integration, please refer to the documentation.

Improved user lifecycle management via SCIM (on-premise only)

For on-premise installations of Burp Suite Enterprise Edition, you can now enable SCIM in order to simplify the process of provisioning and decommissioning users and groups from a central identity provider (IdP).

SCIM is typically integrated in conjunction with SAML. This means you can create, update, and delete your users and groups using SCIM, while SAML is reserved exclusively for authentication via your IdP.

We have fully tested SCIM integrations with the following IdPs:

  • Okta
  • OneLogin

For more information, please refer to the documentation.

Add new sites to a new folder

When adding a new site, you now have the option to create a new folder for it at the same time. Previously, you could only add sites to existing folders.

Bug fixes

We have also fixed a number of bugs, most notably one that caused issues for some users when attempting to update Burp Scanner.


Enterprise Edition 2021.8.1 Released 2021-Sep-8

This release gives several bug fixes; one particularly for a bug that caused an abundant number of email notifications to be sent to some users.

Cloud deployment links

In order to apply this release of Burp Suite Enterprise Edition to the cloud, use the following links to access the corresponding instructions and templates for the preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

Enterprise Edition 2021.8 Released 2021-Aug-25

This release allows you to install extensions and adds some Scanner compatibility improvements, telemetry collection, and some bug fixes.

Extensions support

This release of Burp Suite Enterprise Edition enables you to use extensions to expand and customize its scanning functionality. For example, you could use an extension to scan for a specific vulnerability or to expand your logging.

With this release, Enterprise Edition supports custom extensions written in java and BApps identified as Enterprise Edition compatible. The BApp store has been updated to identify which products each BApp is compatible with. Those with the Enterprise tag can be downloaded from the BApp store and uploaded to the Enterprise extensions library.

Scanner compatibility

Burp Suite Enterprise Edition and Burp Scanner are updated and installed independently. Each component has dependencies (such as the JRE version) that mean not all versions are compatible with each other.

You will get a notification to update your version of Enterprise Edition from Managing updates when you are updating components manually and trying to upgrade to a version of Burp Scanner that is not compatible with your version of Enterprise Edition before installing the new Scanner. You will also receive emails about the release of a new version of Burp Scanner that is incompatible with your version of Enterprise Edition.

Telemetry collection

Starting with this release, we are collecting telemetry that will allow us to understand your usage of Burp Suite Enterprise Edition better, and offer you more cost-effective options. We will not be capturing any information about the sites that you are scanning or any details of your scan results.

Bug fixes

This release includes the following bug fixes:

  • You can now use Cyrillic characters in group names.
  • GraphQL queries no longer return incorrect null values in Issue fields.
  • We fixed several minor bugs.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for the preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

Enterprise Edition 2021.6 Released 2021-Jun-25

This release includes a Java update and several minor improvements as well as bug fixes.

Update to Java 11

Burp Suite Enterprise Edition is updated to Java version 11.

Minor improvements

This release includes the following minor improvements:

  • Change in security settings is not needed when installing Burp Suite Enterprise Edition on a MacOS machine
  • We have made several small improvements to the user interface.

Bug fixes

  • Scans are now reported correctly in the UI and GraphQL if the browser crashes during the scan.
  • The user count now only includes users created directly in Burp Suite Enterprise Edition. External users, such as those logged in via SSO, will no longer be included.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

 

 


Enterprise Edition 2021.4.1 Released 2021-Apr-29

This release gives the ability to arrange agent machines and target sites into pools in order to better organize your scanning resources. There is also significant improvements included to the user interface and navigation like a new scan results page design. It also include several bugs fixes.

Agent machine pools

Agent machines and sites are now organized into agent machine pools. All agent machines and all sites are assigned to one and only one agent machine pool. Unless you specify otherwise, all agent machines and sites will be assigned to the same default pool. An agent will only scan a site if the site belongs to the same agent machine pool as the agent’s machine.

Agent machine pools support the “agent affinity” concept and are useful if you have a need to limit which agent machines can scan certain sites. Agent machine pools stop the problem of a scan failing because the relevant machine is busy elsewhere, or an assigned agent being unable to access a restricted site for a scan. Sample uses for agent machine pools are:

  • Keeping the agent machines and sites for one geographic area together.
  • Allocating the resources of one team.
  • Scanning sites with restricted access.
  • Reserving agent machines for specific purposes, such as a CI/CD pipeline or ad-hoc scanning.

UI and navigation improvements

We have improved the user interface and experience throughout Burp Suite Enterprise Edition. These improvements include:

  • We have improved the way we present scan results, to make access for information quicker and to make understanding the results easier. These changes include a set of tabs to show scan details and a site tree view for scanned sites. See here for the details of the changes.
  • We have added a new wizard to make integration with Jira easier.
  • The interface is now more consistent across Teams pages.
  • We added a page to the help center that directs uses to key category pages of documentation.
  • We improved navigation throughout Burp Suite Enterprise Edition.

New user permission for viewing site login details

We have created a new user permission for viewing login details (credentials and/or recorded login sequences) associated with sites. This permission is not assigned to any user by default.

Bug fixes

This release also includes several bug fixes, including:

  • Migrations to MS-SQL databases no longer fail when the username includes a backslash character.
  • When performing an offline update under Windows, you are now correctly redirected to the updated software.
  • Scans no longer incorrectly report scan failure when the scan path contains 4-byte unicode characters.
  • LDAP connections no longer fail when there are Cyrillic characters in the user name.
  • Filters for the schedule_items query in GraphQL are now enums rather than strings. See more details here.
  • Requesting issue type descriptions through GraphQL now correctly returns the description and remediation.
  • Database transfers to databases with custom names now work correctly.
  • Deleting users who have defined custom scan configurations no longer causes errors.
  • Users with site restrictions creating sites within folders they don’t have permission to view can now correctly see the created site without having to log out and back in again.
  • Performing a GraphQL query of a site’s parent ID via a schedule item in a scan no longer returns an incorrect value.
  • A browser crashing during a browser-powered scan no longer causes an error message and the scan results to be unavailable.

New to release 2021.4.1

This release provides the following bug fix:

  • When upgrading from a previous version of Burp Suite Enterprise Edition and using an MS-SQL database, agent machine pool assignments now work correctly, and the site tree loads without errors.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

Enterprise Edition 2021.4 Released 2021-Apr-23

This release gives the ability to arrange agent machines and target sites into pools in order to better organize your scanning resources. There is also significant improvements included to the user interface and navigation like a new scan results page design. It also include several bugs fixes.

Agent machine pools

All agent machines and all sites are assigned to only one agent machine pool. Unless being specified otherwise by users, all agent machines and sites will be assigned to the same default pool. An agent will only scan a site if the site belongs to the same agent machine pool as the agent’s machine.

Agent machine pools support the “agent affinity” concept and are useful if you have a need to limit which agent machines can scan certain sites. Agent machine pools stop the problem of a scan failing because the relevant machine is busy elsewhere, or an assigned agent being unable to access a restricted site for a scan. The following are the sample uses for agent machine pools:

  • Keeping the agent machines and sites for one geographic area together.
  • Allocating the resources of one team.
  • Scanning sites with restricted access.
  • Reserving agent machines for specific purposes, such as a CI/CD pipeline or ad-hoc scanning.

UI and navigation improvements

We have improved the user interface and experience throughout Burp Suite Enterprise Edition. These improvements include:

  • Improved the presentation of the scan results – access for information are quicker to understand the results easier. These changes include a set of tabs to show scan details and a site tree view for scanned sites. See here for the details of the changes.
  • New wizard to make integration with Jira easier.
  • More consistent interface across Teams pages.
  • A page to the help center that directs uses to key category pages of documentation.
  • Improved navigation throughout Burp Suite Enterprise Edition.

New user permission for viewing site login details

We have created a new user permission for viewing login details (credentials and/or recorded login sequences) associated with sites. This permission is not assigned to any user by default.

Bug fixes

This release includes several bug fixes as below:

  • Migrations to MS-SQL databases no longer fail when the username includes a backslash character.
  • When performing an offline update under Windows, you are now correctly redirected to the updated software.
  • Scans no longer incorrectly report scan failure when the scan path contains 4-byte unicode characters.
  • LDAP connections no longer fail when there are Cyrillic characters in the user name.
  • Filters for the schedule_items query in GraphQL are now enums rather than strings. See more details here.
  • Requesting issue type descriptions through GraphQL now correctly returns the description and remediation.
  • Database transfers to databases with custom names now work correctly.
  • Deleting users who have defined custom scan configurations no longer causes errors.
  • Users with site restrictions creating sites within folders they don’t have permission to view can now correctly see the created site without having to log out and back in again.
  • Performing a GraphQL query of a site’s parent ID via a schedule item in a scan no longer returns an incorrect value.
  • A browser crashing during a browser-powered scan no longer causes an error message and the scan results to be unavailable.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

Enterprise Edition 2021.3.1 Released 2021-Mar-24

This release provides several major enhancements to our cloud-friendly version of Burp Suite Enterprise Edition, as well as support for a new database version.

Additional database support

You can now use an Oracle 19c database with Burp Suite Enterprise Edition. For a full list of supported database types, please refer to the system requirements.

Nested cloud templates

Both the main AWS CloudFormation template and the Azure Resource Manager template now comprise multiple “nested” templates, each with their own URL. This gives you the option to skip parts of the template and perform some of the process independently.

For example, you may prefer to set up the required infrastructure on your own and just use the template to deploy the main application. In this case, instead of entering the top-level URL for the full template in AWS/Azure, you can now just enter the URL for the deployment part.

You can find the URLs for the nested templates within the main template for each platform. We’ve also provided direct links at the bottom of these release notes. If you still want to use the full template, you can just ignore the nested ones and use the main URL in the same way as before.

Role-based access control using AWS Identity and Access Management

We now support role-based access control (RBAC) for the entire deployment process on AWS.

In previous releases, you had to provide an AWS access key and secret for the user who would be performing the deployment. This requirement has been removed completely. Instead, our IAM CloudFormation template now automatically generates roles that cover all of the required permissions, along with a corresponding group. Simply assigning the user to this group will allow them to perform the rest of the deployment.

Optional PostgreSQL database for AWS

The main AWS CloudFormation template now provides the option to automatically create and configure a new PostgreSQL database using Amazon’s Relational Database Service (RDS). This should make it much easier to get started as you won’t have to manually set up and connect to a database; most of the configuration will be done for you.

This is completely optional. If you prefer, you can still connect to any of our supported database types in the same way as before.

Improved logging for AWS deployment

On AWS, application logging is now enabled at the beginning of the deployment phase. This means that any errors that occur during the database migration will now be captured in CloudWatch, which should help with debugging.

Obfuscated credentials in AWS

All credentials that you provide in the CloudFormation template are now obfuscated. This prevents them from being viewed by other users who have access to your Burp Suite Enterprise Edition resources in the AWS Management Console.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS instructions
  • AWS IAM CloudFormation template
  • AWS main CloudFormation template
    • Nested infrastructure template
    • Nested database initialization template
    • Nested deployment template

Azure

  • Azure instructions
  • Azure Resource Manager template
    • Nested infrastructure template
    • Nested deployment template

Enterprise Edition 2021.3 Released 2021-Mar-8

This release includes several enhancements that help you to better integrate Burp Suite Enterprise Edition with other web applications. It also adds support for some additional database versions, along with a significant number of minor improvements and bug fixes.

CORS whitelisting for enhanced integration with other web applications

If you want to integrate Burp Suite Enterprise Edition with a third-party web application, or one that you’ve developed yourself, it probably needs access to your sites and scan data. This release adds a new option that lets you whitelist trusted origins for cross-origin resource sharing (CORS) via the GraphQL API.

Once you’ve whitelisted the origin on which your other application is running, its client-side JavaScript will have access to the full functionality exposed by the GraphQL API. This allows you to develop more powerful integrated applications that can fetch the relevant data, create and edit sites, and launch new scans directly from the browser using AJAX.

By default, all cross-origin requests initiated by JavaScript in the browser will be blocked unless you have explicitly whitelisted their origin. To do this, go to the network settings page and add trusted origins to the “Allowed Origins for GraphQL API” list.

Improvements to the GraphQL API

  • You can now include an optional schedule_item_id parameter in a scans query. This makes it much easier to locate the Scan that was generated by a ScheduleItem you’ve just created.
  • You can use the new site query to fetch an individual Site by its ID. This means you no longer have to fetch the whole SiteTree in order to query a specific known Site.
  • You can now send gzip-encoded data to the API.

Additional database support

Burp Suite Enterprise Edition now supports the following additional database versions:

  • PostgreSQL 11, 12, and 13
  • MariaDB 10.4 and 10.5

For a full list of databases that you can use with Burp Suite Enterprise Edition, please check the system requirements.

Other improvements

  • If you upload an invalid recorded login script, you are now informed of this when you try to save so that you can fix the issue right away. Previously, you would only know that your script was invalid once a scan started and subsequently failed to log in.
  • You can no longer add end-of-scan report recipients to a site unless an admin user has configured a connection to an email server. This helps prevent situations where you mistakenly believe that colleagues are receiving scan reports even though no emails are actually being sent.
  • Burp Scanner’s embedded Chromium browser is now stored in the data directory that you select in the installation wizard. Previously, this would be unpacked in your home directory, which was causing issues for some customers.
  • On the “Site” > “Details” page, if you click on the ? icon to view the scan configuration, the configuration ID is now displayed in the URL in your browser’s address bar for easier access.
  • When you cancel a scan with errors, the error message is now displayed in the “Cancel scan” confirmation dialog.

Bug fixes

  • The link for the REST API is now generated using the correct domain name for your web server. Previously, the default IP address would still be used to generate the API link even if you had manually set a different “Web server URL” in the network settings.
  • A problem with our site-tree caching has been fixed. This should dramatically improve performance when using our APIs.
  • The database transfer tool no longer assumes that the agent user for the database is called burp_agent. You can now use the tool even if you assigned a different username when setting up your database.
  • A problem with the network settings page has been fixed. A bug in the previous release meant that you were unable to save changes to other settings while the “Use TLS” option was enabled.
  • Adding client TLS certificates to a scan configuration now works as expected. A bug in the previous release meant that you would sometimes encounter a “value required” error when trying to upload a new certificate.
  • We have also fixed several minor UI-related bugs that were introduced by some of our recent changes.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS main CloudFormation template
  • AWS IAM CloudFormation template
  • AWS instructions

Azure

  • Azure Resource Manager template
  • Azure instructions

Enterprise Edition 2021.1 Released 2021-Feb-2

This release provides the following bug fixes:

  • The process for deploying to Azure now works as expected.
  • Browser-powered scans are now supported on cloud-based deployments of Burp Suite Enterprise Edition. A bug in the previous release prevented Burp Scanner‘s embedded browser from starting properly.

Enterprise Edition 2020.12 Release 2020-Dec-23

This release provides the following improvements and bug fixes.

UI refresh

The UI now has a more modern look and feel. We hope you like the new design as much as we do.

New Help center and troubleshooting features

Users with permission to modify the settings can access the new “Help center” by clicking the ? icon in the upper-right corner of the screen. This provides a range of new features to help troubleshoot issues with your setup:

  • Diagnostics – This page provides quick access to all the background information our support team needs to know when you report an issue. It contains some basic details about your installation, memory usage, operating system, and so on. This enables you to quickly copy and paste all of this information from one place, rather than having to track it down across your system.
  • Debug – From time to time, the support team may ask you to enable detailed debugging for specific areas of Burp Suite Enterprise Edition. In this case, they will provide a series of values that you should enter on this page. This temporarily increases the level of detail that is included in the logs, which will help our support team get to the bottom of any issues.
  • Support pack – The support team may occasionally ask you to provide a collection of log files to help them troubleshoot an issue that you’ve reported. This page enables you to download various different logs as a single file so that you can easily send them to our support team.

This release also adds the following new options for downloading logs:

  • You can now download the logs for an individual scan. To do this, go to the scan details page for the relevant scan and select “More actions” > “Download scan log”. Note that the log is only available for scans that:
    • Were successfully assigned to an agent
    • Have run or started running since you upgraded to Burp Suite Enterprise Edition 2020.12
    • Are less than 10 days old
  • You can now download the logs for an individual agent machine. To do this, go to the “Agents” page and select the relevant agent machine. In the upper-right corner, click “Download logs”.

Bug fixes

  • When trying to connect to Jira, receiving a response that is larger than 2 MB no longer triggers an exception.
  • In the “Database backup” settings, specifying a save location with dots in the path no longer causes issues. Previously, you would be prevented from saving your changes if you entered a path such as /home/user/example.directory/.
  • When transferring a SQL Server database with the transfer tool, you can now successfully use any target database name. Previously, the transfer would fail if the target name was anything other than burp_enterprise.

 


Enterprise Edition 2020.11 Release 2020-Nov-16

This release provides a new application logins option that will enable scans to handle single sign-on and other complex login mechanisms. Please note that this upgrade includes some major changes to the GraphQL API as a result.

Recorded login sequences

When adding application logins to a site, instead of simply adding basic sets of user credentials, you now have the option to upload recorded login sequences instead. A recorded login sequence is essentially a script that tells Burp Scanner exactly how to log in to the site. This enables it to handle more complex login mechanisms, including single sign-on.

To generate this script, you use our dedicated Chrome extension to record your browser interactions while you perform the login sequence manually. You then upload this script to the relevant site in Burp Suite Enterprise Edition. When scans of this site begin an authenticated crawl, Burp Scanner will start a new session in its embedded browser and use this script to replicate your actions, performing the full login sequence from scratch.

For more information, please refer to the documentation.

API scanning

Burp Scanner is now able to scan both JSON and YAML-based APIs for vulnerabilities. By default, the crawler attempts to parse any API definitions that it encounters to identify potential endpoints, along with their supported methods and parameters. Based on the endpoints that it discovers, Burp Scanner is then able to derive new locations to crawl and audit.

You can also explicitly provide the URL of an API definition in the list of included URLs for a site.

If you prefer, you can disable API scanning by deselecting the “Parse API definitions” crawl option in your scan configuration. You can find this option under “Miscellaneous”.

Please note that this initial release only supports scanning of a fairly limited range of REST APIs. For a full list of the prerequisites and limitations, please refer to the Burp Scanner documentation. We plan to further develop this feature and gradually add support for a wider range of APIs in future releases.

GraphQL API updates

In order to implement the new functionality for uploading recorded login sequences, we’ve had to make some changes to the GraphQL API. These changes may require you to refactor your existing integrations before they will work with this version of Burp Suite Enterprise Edition.

Generally speaking, the entities related to application logins have now been split in two. This is to create the distinction between sets of basic login credentials and recorded login sequences.

The full list of changes is as follows:

  • The type ApplicationLogin is now obsolete. This has been replaced by two new types, LoginCredential and RecordedLogin.
  • The new type ApplicationLogins has been added. This provides two fields, login_credentials and recorded_logins, which contain a list of LoginCredential and RecordedLogin objects respectively.
  • Fields that used to contain a list of the obsolete ApplicationLogin objects now contain a single object of the new type ApplicationLogins. This affects the following fields:
    • The site_application_logins and schedule_item_application_logins fields of Scan objects
    • The application_logins field of Site objects
  • The following mutations are now obsolete:
    • create_site_application_login
    • update_site_application_login
    • delete_site_application_login

    These have been replaced by the following new mutations:

    • create_site_login_credential
    • create_site_recorded_login
    • update_site_login_credential
    • delete_site_login_credential
    • delete_site_recorded_login

Please note that you can add either LoginCredential or RecordedLogin objects to a Site, but not both. Querying the application_logins field for a Site will return a single ApplicationLogins object for which only one of the login_credentials and recorded_logins fields will contain data.

Improved logging

We have improved the logging of certain processes, which should make it easier to troubleshoot any problems that arise. For example, there is now much greater transparency in the log entries when backing up your database. When errors occur with Jira, the log now also provides much more detail about what the problem is.

When a scan check is abandoned due to memory allocation issues, this is now indicated in the scan results, the list of scans, and the downloadable reports. Previously, this would only be mentioned in the event log, which meant that it was easy to miss.

Bug fixes

This release also provides the following bug fixes:

  • The installer now works for users with an external database.
  • The database migration scripts no longer fail when migrating a PostgreSQL or MySQL database on Azure.
  • When the Enterprise server is connected to your SMTP server but cannot connect to portswigger.net, you no longer receive an excessive number of emails about this issue.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred platform.

AWS

  • AWS main CloudFormation template
  • AWS IAM CloudFormation template
  • AWS instructions

Azure

  • Azure Resource Manager template
  • Azure instructions

Enterprise Edition 2020.10.1 Release 2020-Oct-19

Bug fix

This release fixes a bug in the installer that affected some customers using an Oracle database. Previously, the installer would fail if the database schema name was anything other than burp_enterprise.

Cloud deployment links

If you want to deploy this release of Burp Suite Enterprise Edition to the cloud, you can use the links below to access the corresponding templates and instructions for your preferred cloud platform.

AWS

  • AWS main CloudFormation template
  • AWS IAM CloudFormation template
  • AWS instructions

Azure

  • Azure Resource Manager template
  • Azure instructions

Enterprise Edition 2020.10 Release 2020-Oct-15

This release further improves Burp Suite Enterprise Edition‘s support for single sign-on by enabling SAML integration. It also provides major improvements to the AWS deployment process.

SAML integration

Burp Suite Enterprise Edition now supports SAML-based single sign-on. This is particularly useful for managing user authentication for cloud-based deployments.

You can integrate SAML SSO using any identity provider (IdP), but the following ones have been fully tested:

  • Active Directory Federation Services (ADFS)
  • Okta
  • Azure Active Directory

To configure the connection to your preferred SAML IdP, log in to Burp Suite Enterprise Edition as an administrator, select “Single sign-on” from the settings menu, then open the “SAML connection” tab.

For more detailed information, please refer to the accompanying documentation.

Other improvements

This release also provides the following improvements:

  • When marking all issues of the same type as false positives, you can now choose to limit this to the current scan only.
  • Empty placeholder pages have been improved. In each case, you will now be informed why the page is empty and prompted to perform the relevant actions to populate it with data.
  • Sites and folders are now displayed in alphabetical order in the site tree.
  • Performance has been improved when running scans that use a large number of scan configurations.

Burp Suite Enterprise Edition on the cloud

This release provides major usability improvements to the deployment process for Burp Suite Enterprise Edition on AWS.

Most notably, the CloudFormation template now creates all of the required AWS infrastructure for you. This includes creating a new Virtual Private Cloud (VPC), so you no longer need to set this up manually. We hope that this will make it much easier to get up and running.

Secondly, there are now two CloudFormation templates for each release of Burp Suite Enterprise Edition:

  • The main template, which is used to create the required AWS environment and deploy the application.
  • The IAM template, which is used to create the relevant IAM users.

Previously, some customers faced issues when the user performing the deployment did not have the appropriate permissions to create IAM users. Now that this is handled in a separate template, you can easily hand over this part of the setup process to the relevant team within your organization.

If you want to deploy Burp Suite Enterprise Edition 2020.10 to the cloud for beta testing, you can download the template for your preferred cloud platform from the links below.

AWS

  • AWS main CloudFormation template
  • AWS IAM CloudFormation template
  • AWS instructions

Azure

  • Azure Resource Manager template
  • Azure instructions

Bug Fixes

We have also provided the following bug fixes:

  • Reinstalling Burp Suite Enterprise Edition for use with an existing database no longer causes issues.
  • You can now successfully run the installer over an existing installation, for example, to fix any missing libraries.
  • When the API key is generated for a new API user, long domain names no longer cause the URL to exceed the boundaries of the text field.
  • The option for creating Jira sub-tasks has been removed to avoid invalid issue type errors. Creating sub-tasks is not supported by the Jira API.
  • You can now update the port for your web server’s HTTPS URL without having to upload a new certificate.
  • We have made minor corrections to the GraphQL API reference documentation.

Enterprise Edition 2020.7 Release 2020-Jul-23

This release provides several improvements to our APIs and continues the ongoing improvements to the Burp Suite Enterprise Edition UI.

GraphQL API

We recently released a new GraphQL API to improve the integration of Burp Suite Enterprise Edition with other tools. This release implements the following changes:

  • You can now apply a site_id filter to the scans query. This enables you to fetch all scans for a given site.
  • When fetching issues for a scan, specifying a type_index is now optional. This enables you to fetch all issues for a scan directly. Previously, you first had to fetch the issues grouped by type.
  • We’ve added a new type IssueType, which contains information relevant to a specific issue type, such as a description and remediation advice. Instances of the type Issue now also contain an issue_type field that allows you to fetch this information.

We have also made the following adjustments to the names of some entities:

  • To allow for the new type IssueType, the query issue_types has been renamed to issue_type_groups. Similarly, the existing type IssueType has now been renamed to IssueTypeGroup.
  • For the input object DeauthorizeAgentInput, we have renamed the machine_id field to just id.

REST API

When you apply a custom scan configuration to a scan using the REST API, you can now save it as a named configuration for reuse in future scans. Previously, a custom scan configuration assigned using the REST API would be deleted after the scan was completed.

UI improvements

This release provides more improvements to the Burp Suite Enterprise Edition UI. The placeholder pages that are displayed before you have added a site or run a scan are now much more intuitive.

Bug fixes

We’ve also provided several minor bug fixes, most notably:

  • Active Directory users can now view the scan results by clicking on a scan.
  • Scans that fail to start now appear as failed in the list of scans. This frees up the assigned agent so that you can use it to perform another scan.

Burp Suite Enterprise Edition Cloud

If you want to deploy Burp Suite Enterprise Edition 2020.7 to the cloud for beta testing, you can download the corresponding template for your preferred cloud platform AWS or Azure.


Enterprise Edition 2020.6 Release 2020-Jul-7

This release provides major usability improvements and adds support for single sign-on. We are also pleased to announce a beta release for the cloud-native Burp Suite Enterprise Edition on both AWS and Azure.

UI improvements

Over the next few months, we’re working on improving the usability of Burp Suite Enterprise Edition by upgrading the UI. This release includes the first set of these changes:

  • The header menu has been redesigned to make it much easier to navigate. You can now jump straight to the most commonly used parts of the application with a single click.
  • The pages for creating, editing, and viewing both sites and scans have been redesigned to make them much more intuitive.
  • The overall look-and-feel of some screens has been updated. These changes will be rolled out across other parts of the application in upcoming releases.

Single sign-on

You can now configure an LDAP connection between Burp Suite Enterprise Edition and your Active Directory. This enables you to manage your Burp Suite Enterprise Edition users centrally using single sign-on, just like you might already do with other applications.

Once you configure the connection, you simply create user groups in Burp Suite Enterprise Edition that correspond to the groups in your Active Directory. Users can then log in using their existing credentials. User permissions within the application are controlled on the group level, removing the need to create and manage dedicated users for Burp Suite Enterprise Edition.

For more information, please refer to the product documentation.

Burp Suite Enterprise Edition on the cloud

A beta release is now available for deploying Burp Suite Enterprise Edition natively on both AWS and Azure.

Note that you will need a separate Burp Suite Enterprise Edition license for your cloud-based deployment, even if you already have a license for an on-premise installation. You can request a trial license or purchase a new license from portswigger.net.

You can use the links below to download the corresponding template for deploying to your preferred platform. We have also provided installation instructions to help get you started.

AWS

      • AWS CloudFormation template
      • AWS instructions

Azure

      • Azure Resource Manager template
      • Azure instructions

Bug fixes

We have also implemented several minor bug fixes and performance improvements.


Enterprise Edition 2021.4.1 Release 2021-Apr-29

This release provides the ability to arrange your agent machines and target sites into pools, to better organize your scanning resources. It also includes significant improvements to the user interface and navigation such as a new scan results page design. The release also fixes several bugs.

Agent machine pools

Agent machines and sites are now organized into agent machine pools. All agent machines and all sites are assigned to one and only one agent machine pool. Unless you specify otherwise, all agent machines and sites will be assigned to the same default pool. An agent will only scan a site if the site belongs to the same agent machine pool as the agent’s machine.

Agent machine pools support the “agent affinity” concept and are useful if you have a need to limit which agent machines can scan certain sites. Agent machine pools stop the problem of a scan failing because the relevant machine is busy elsewhere, or an assigned agent being unable to access a restricted site for a scan. Sample uses for agent machine pools are:

  • Keeping the agent machines and sites for one geographic area together.
  • Allocating the resources of one team.
  • Scanning sites with restricted access.
  • Reserving agent machines for specific purposes, such as a CI/CD pipeline or ad-hoc scanning.

UI and navigation improvements

We have improved the user interface and experience throughout Burp Suite Enterprise Edition. These improvements include:

  • We have improved the way we present scan results, to make access for information quicker and to make understanding the results easier. These changes include a set of tabs to show scan details and a site tree view for scanned sites.
  • We have added a new wizard to make integration with Jira easier.
  • The interface is now more consistent across Teams pages.
  • We added a page to the help center that directs uses to key category pages of documentation.
  • We improved navigation throughout Burp Suite Enterprise Edition.

New user permission for viewing site login details

We have created a new user permission for viewing login details (credentials and/or recorded login sequences) associated with sites. This permission is not assigned to any user by default.

Bug fixes

This release also includes several bug fixes, including:

  • Migrations to MS-SQL databases no longer fail when the username includes a backslash character.
  • When performing an offline update under Windows, you are now correctly redirected to the updated software.
  • Scans no longer incorrectly report scan failure when the scan path contains 4-byte unicode characters.
  • LDAP connections no longer fail when there are Cyrillic characters in the user name.
  • Filters for the schedule_items query in GraphQL are now enums rather than strings.
  • Requesting issue type descriptions through GraphQL now correctly returns the description and remediation.
  • Database transfers to databases with custom names now work correctly.
  • Deleting users who have defined custom scan configurations no longer causes errors.
  • Users with site restrictions creating sites within folders they don’t have permission to view can now correctly see the created site without having to log out and back in again.
  • Performing a GraphQL query of a site’s parent ID via a schedule item in a scan no longer returns an incorrect value.
  • A browser crashing during a browser-powered scan no longer causes an error message and the scan results to be unavailable.

Enterprise Edition 2021.4 Release 2021-Apr-23

This release provides the ability to arrange your agent machines and target sites into pools, to better organize your scanning resources. It also includes significant improvements to the user interface and navigation such as a new scan results page design. The release also fixes several bugs.

Agent machine pools

Agent machines and sites are now organized into agent machine pools. All agent machines and all sites are assigned to one and only one agent machine pool. Unless you specify otherwise, all agent machines and sites will be assigned to the same default pool. An agent will only scan a site if the site belongs to the same agent machine pool as the agent’s machine.

Agent machine pools support the “agent affinity” concept and are useful if you have a need to limit which agent machines can scan certain sites. Agent machine pools stop the problem of a scan failing because the relevant machine is busy elsewhere, or an assigned agent being unable to access a restricted site for a scan. Sample uses for agent machine pools are:

  • Keeping the agent machines and sites for one geographic area together.
  • Allocating the resources of one team.
  • Scanning sites with restricted access.
  • Reserving agent machines for specific purposes, such as a CI/CD pipeline or ad-hoc scanning.

UI and navigation improvements

We have improved the user interface and experience throughout Burp Suite Enterprise Edition. These improvements include:

  • We have improved the way we present scan results, to make access for information quicker and to make understanding the results easier. These changes include a set of tabs to show scan details and a site tree view for scanned sites.
  • We have added a new wizard to make integration with Jira easier.
  • The interface is now more consistent across Teams pages.
  • We added a page to the help center that directs uses to key category pages of documentation.
  • We improved navigation throughout Burp Suite Enterprise Edition.

New user permission for viewing site login details

We have created a new user permission for viewing login details (credentials and/or recorded login sequences) associated with sites. This permission is not assigned to any user by default.

Bug fixes

This release also includes several bug fixes, including:

  • Migrations to MS-SQL databases no longer fail when the username includes a backslash character.
  • When performing an offline update under Windows, you are now correctly redirected to the updated software.
  • Scans no longer incorrectly report scan failure when the scan path contains 4-byte unicode characters.
  • LDAP connections no longer fail when there are Cyrillic characters in the user name.
  • Filters for the schedule_items query in GraphQL are now enums rather than strings.
  • Requesting issue type descriptions through GraphQL now correctly returns the description and remediation.
  • Database transfers to databases with custom names now work correctly.
  • Deleting users who have defined custom scan configurations no longer causes errors.
  • Users with site restrictions creating sites within folders they don’t have permission to view can now correctly see the created site without having to log out and back in again.
  • Performing a GraphQL query of a site’s parent ID via a schedule item in a scan no longer returns an incorrect value.
  • A browser crashing during a browser-powered scan no longer causes an error message and the scan results to be unavailable.

Enterprise Edition 2021.3.1 Release 2021-Mar-23

This release provides several major enhancements to our cloud-friendly version of Burp Suite Enterprise Edition, as well as support for a new database version.

Additional database support

You can now use an Oracle 19c database with Burp Suite Enterprise Edition. For a full list of supported database types, please refer to the system requirements.

Nested cloud templates

Both the main AWS CloudFormation template and the Azure Resource Manager template now comprise multiple “nested” templates, each with their own URL. This gives you the option to skip parts of the template and perform some of the process independently.

For example, you may prefer to set up the required infrastructure on your own and just use the template to deploy the main application. In this case, instead of entering the top-level URL for the full template in AWS/Azure, you can now just enter the URL for the deployment part.

You can find the URLs for the nested templates within the main template for each platform. We’ve also provided direct links at the bottom of these release notes. If you still want to use the full template, you can just ignore the nested ones and use the main URL in the same way as before.

Role-based access control using AWS Identity and Access Management

We now support role-based access control (RBAC) for the entire deployment process on AWS.

In previous releases, you had to provide an AWS access key and secret for the user who would be performing the deployment. This requirement has been removed completely. Instead, our IAM CloudFormation template now automatically generates roles that cover all of the required permissions, along with a corresponding group. Simply assigning the user to this group will allow them to perform the rest of the deployment.

Optional PostgreSQL database for AWS

The main AWS CloudFormation template now provides the option to automatically create and configure a new PostgreSQL database using Amazon’s Relational Database Service (RDS). This should make it much easier to get started as you won’t have to manually set up and connect to a database; most of the configuration will be done for you.

This is completely optional. If you prefer, you can still connect to any of our supported database types in the same way as before.

Improved logging for AWS deployment

On AWS, application logging is now enabled at the beginning of the deployment phase. This means that any errors that occur during the database migration will now be captured in CloudWatch, which should help with debugging.

Obfuscated credentials in AWS

All credentials that you provide in the CloudFormation template are now obfuscated. This prevents them from being viewed by other users who have access to your Burp Suite Enterprise Edition resources in the AWS Management Console.


Enterprise Edition generic CI/CD driver 2021.3 Release 2021-Mar-18

This release greatly improves the usability of Burp Suite Enterprise Edition’s generic, platform-agnostic CI/CD driver by adding a new “site-driven scan” integration option. Don’t worry, it still includes the legacy “Burp scan” option, which you can use in the same way as before. This means you can make the switch to the new driver without breaking your existing integrations.

Prerequisites

Please note that in order to use the new site-driven scan option, you also need to upgrade Burp Suite Enterprise Edition to version 2021.3 or higher.

What is the CI/CD driver?

Our CI/CD driver enables you to integrate automated vulnerability scans into your existing pipelines on almost any platform. You can then configure rules for failing the build based on the scan’s results. This helps you to catch bugs earlier in your development process by adopting a DevSecOps approach, with minimal disruption to your existing workflow.

Our platform-agnostic driver comes in the form of a JAR file, which you simply run from a command-line build step in your CI/CD pipeline. Any configuration options are set using a series of parameters.

If you use Jenkins or TeamCity, please be aware we also provide native plugins for both of these platforms. The plugins offer all of the same functionality as our generic CI/CD driver, but they allow you to configure the various options via the native platform UI instead of using shell commands. Both of these plugins are also available from our releases page

Site-driven scans

The new “site-driven scan” integration option provides the following key advantages.

Manual site matching

Your sites are automatically fetched from Burp Suite Enterprise Edition via its GraphQL API. This means that when adding a vulnerability scan to your pipeline, you can manually select the exact site that it relates to. Previously, you had to rely on the automated site-matching rules.

Manually matching your sites and scans ensures that all of your scan data is associated with the correct site and that results are seamlessly aggregated from both user-created and CI/CD-generated scans. This allows you to take full advantage of Burp Suite Enterprise Edition’s powerful analytics features and accurately monitor changes to your security posture over time.

Greatly simplified integration process

Site-driven scans also have access to most of your site data from Burp Suite Enterprise Edition. This includes the default scan configurations, URL scope, false positive settings, and so on. As a result, you no longer need to manually provide this information in your build step. This makes the integration process much simpler and removes the need to create custom JSON scan definitions.

Instead, you simply create and configure your site as normal using Burp Suite Enterprise Edition’s intuitive web UI. You can then test your site and scan configuration by running a few scans manually, tweaking the behavior if necessary. Once you’re satisfied with everything, you just select this site from your CI/CD build step and all of these settings will be used automatically. Any subsequent changes you make to your site in the Burp Suite Enterprise Edition web UI will be automatically reflected in your CI/CD system the next time you run a build.

Burp scans

To provide continued support for any existing integrations that you may have configured, this release also retains the legacy “Burp scan” option in its original form.

This is useful in some cases, such as when you want to run a one-off scan and do not want its results to be linked to a particular site. However, for most new integrations, we recommend using the new site-driven scan option instead.

For more detailed information about the pros and cons of both approaches, please refer to the documentation.


Enterprise Edition Jenkins plugin 2021.3 Released 2021-Mar-18

This release greatly improves the usability of Burp Suite Enterprise Edition’s native Jenkins plugin by adding a new “site-driven scan” integration option. Don’t worry, it still includes the legacy “Burp scan” option, which you can use in the same way as before. This means you can upgrade to the new plugin without breaking your existing integrations.

Prerequisites

Please note that in order to use the new site-driven scan option, you also need to upgrade Burp Suite Enterprise Edition to version 2021.3 or higher.

What is the Jenkins plugin?

Our native Jenkins plugin enables you to integrate automated vulnerability scans into your existing pipelines and configure rules for failing the build based on the scan’s results. This helps you to catch bugs earlier in your development process by adopting a DevSecOps approach, with minimal disruption to your existing workflow.

The plugin offers all of the same functionality as our generic CI/CD driver, but also adds two custom build step types to Jenkins. This allows you to configure the various options using the Jenkins web interface rather than having to use a shell command.

Site-driven scans

The new “site-driven scan” integration option provides the following key advantages.

Manual site matching

Your sites are automatically fetched from Burp Suite Enterprise Edition via its GraphQL API. This means that when adding a vulnerability scan to your pipeline, you can manually select the exact site that it relates to. Previously, you had to rely on the automated site-matching rules.

Manually matching your sites and scans ensures that all of your scan data is associated with the correct site and that results are seamlessly aggregated from both user-created and Jenkins-generated scans. This allows you to take full advantage of Burp Suite Enterprise Edition’s powerful analytics features and accurately monitor changes to your security posture over time.

Greatly simplified integration process

Site-driven scans also have access to most of your site data from Burp Suite Enterprise Edition. This includes the default scan configurations, URL scope, false positive settings, and so on. As a result, you no longer need to manually provide this information in your build step. This makes the integration process much simpler and removes the need to create custom JSON scan definitions.

Instead, you simply create and configure your site as normal using Burp Suite Enterprise Edition’s intuitive web UI. You can then test your site and scan configuration by running a few scans manually, tweaking the behavior if necessary. Once you’re satisfied with everything, you just select this site from your Jenkins build step and all of these settings will be used automatically. Any subsequent changes you make to your site in the Burp Suite Enterprise Edition web UI will be automatically reflected in Jenkins the next time you run a build.

Burp scans

To provide continued support for any existing integrations that you may have configured, this release also retains the legacy “Burp scan” option in its original form.

This is useful in some cases, such as when you want to run a one-off scan and do not want its results to be linked to a particular site. However, for most new integrations, we recommend using the new site-driven scan option instead.

For more detailed information about the pros and cons of both approaches, please refer to the documentation.


Enterprise Edition TeamCity plugin 2021.3 Release 2021-Mar-18

This release greatly improves the usability of Burp Suite Enterprise Edition’s native TeamCity plugin by adding a new “site-driven scan” integration option. Don’t worry, it still includes the legacy “Burp scan” option, which you can use in the same way as before. This means you can upgrade to the new plugin without breaking your existing integrations.

Prerequisites

Please note that in order to use the new site-driven scan option, you also need to upgrade Burp Suite Enterprise Edition to version 2021.3 or higher.

What is the TeamCity plugin?

Our native TeamCity plugin enables you to integrate automated vulnerability scans into your existing pipelines and configure rules for failing the build based on the scan’s results. This helps you to catch bugs earlier in your development process by adopting a DevSecOps approach, with minimal disruption to your existing workflow.

The plugin offers all of the same functionality as our generic CI/CD driver, but also adds two custom build step runner types to TeamCity. This allows you to configure the various options using the TeamCity web interface rather than having to use a shell command.

Site-driven scans

The new “site-driven scan” option provides the following key advantages.

Manual site matching

Your sites are automatically fetched from Burp Suite Enterprise Edition via its GraphQL API. This means that when adding a vulnerability scan to your pipeline, you can manually select the exact site that it relates to. Previously, you had to rely on the automated site-matching rules.

Manually matching your sites and scans ensures that all of your scan data is associated with the correct site and that results are seamlessly aggregated from both user-created and TeamCity-generated scans. This allows you to take full advantage of Burp Suite Enterprise Edition’s powerful analytics features and accurately monitor changes to your security posture over time.

Greatly simplified integration process

Site-driven scans also have access to most of your site data from Burp Suite Enterprise Edition. This includes the default scan configurations, URL scope, false positive settings, and so on. As a result, you no longer need to manually provide this information in your build step. This makes the integration process much simpler and removes the need to create custom JSON scan definitions.

Instead, you simply create and configure your site as normal using Burp Suite Enterprise Edition’s intuitive web UI. You can then test your site and scan configuration by running a few scans manually, tweaking the behavior if necessary. Once you’re satisfied with everything, you just select this site from your TeamCity build step and all of these settings will be used automatically. Any subsequent changes you make to your site in the Burp Suite Enterprise Edition web UI will be automatically reflected in TeamCity the next time you run a build.

Burp scans

To provide continued support for any existing integrations that you may have configured, this release also retains the legacy “Burp scan” option in its original form.

This is useful in some cases, such as when you want to run a one-off scan and do not want its results to be linked to a particular site. However, for most new integrations, we recommend using the new site-driven scan option instead.

For more detailed information about the pros and cons of both approaches, please refer to the documentation.


Enterprise Edition 2021.3 Release 2021-Mar-8

This release includes several enhancements that help you to better integrate Burp Suite Enterprise Edition with other web applications. It also adds support for some additional database versions, along with a significant number of minor improvements and bug fixes.

CORS whitelisting for enhanced integration with other web applications

If you want to integrate Burp Suite Enterprise Edition with a third-party web application, or one that you’ve developed yourself, it probably needs access to your sites and scan data. This release adds a new option that lets you whitelist trusted origins for cross-origin resource sharing (CORS) via the GraphQL API.

Once you’ve whitelisted the origin on which your other application is running, its client-side JavaScript will have access to the full functionality exposed by the GraphQL API. This allows you to develop more powerful integrated applications that can fetch the relevant data, create and edit sites, and launch new scans directly from the browser using AJAX.

By default, all cross-origin requests initiated by JavaScript in the browser will be blocked unless you have explicitly whitelisted their origin. To do this, go to the network settings page and add trusted origins to the “Allowed Origins for GraphQL API” list.

Improvements to the GraphQL API

  • You can now include an optional schedule_item_id parameter in a scans query. This makes it much easier to locate the Scan that was generated by a ScheduleItem you’ve just created.
  • You can use the new site query to fetch an individual Site by its ID. This means you no longer have to fetch the whole SiteTree in order to query a specific known Site.
  • You can now send gzip-encoded data to the API.

Additional database support

Burp Suite Enterprise Edition now supports the following additional database versions:

  • PostgreSQL 11, 12, and 13
  • MariaDB 10.4 and 10.5

For a full list of databases that you can use with Burp Suite Enterprise Edition, please check the system requirements.

Other improvements

  • If you upload an invalid recorded login script, you are now informed of this when you try to save so that you can fix the issue right away. Previously, you would only know that your script was invalid once a scan started and subsequently failed to log in.
  • You can no longer add end-of-scan report recipients to a site unless an admin user has configured a connection to an email server. This helps prevent situations where you mistakenly believe that colleagues are receiving scan reports even though no emails are actually being sent.
  • Burp Scanner’s embedded Chromium browser is now stored in the data directory that you select in the installation wizard. Previously, this would be unpacked in your home directory, which was causing issues for some customers.
  • On the “Site” > “Details” page, if you click on the ? icon to view the scan configuration, the configuration ID is now displayed in the URL in your browser’s address bar for easier access.
  • When you cancel a scan with errors, the error message is now displayed in the “Cancel scan” confirmation dialog.

Bug fixes

  • The link for the REST API is now generated using the correct domain name for your web server. Previously, the default IP address would still be used to generate the API link even if you had manually set a different “Web server URL” in the network settings.
  • A problem with our site-tree caching has been fixed. This should dramatically improve performance when using our APIs.
  • The database transfer tool no longer assumes that the agent user for the database is called burp_agent. You can now use the tool even if you assigned a different username when setting up your database.
  • A problem with the network settings page has been fixed. A bug in the previous release meant that you were unable to save changes to other settings while the “Use TLS” option was enabled.
  • Adding client TLS certificates to a scan configuration now works as expected. A bug in the previous release meant that you would sometimes encounter a “value required” error when trying to upload a new certificate.
  • We have also fixed several minor UI-related bugs that were introduced by some of our recent changes.

Enterprise Edition 2021.1 Release 2021-Feb-2

This release provides the following bug fixes:

  • The process for deploying to Azure now works as expected.
  • Browser-powered scans are now supported on cloud-based deployments of Burp Suite Enterprise Edition. A bug in the previous release prevented Burp Scanner’s embedded browser from starting properly.

Enterprise Edition 2020.12 Release 2020-Dec-23

This release provides the following improvements and bug fixes.

UI refresh

The UI now has a more modern look and feel. We hope you like the new design as much as we do.

New Help center and troubleshooting features

Users with permission to modify the settings can access the new “Help center” by clicking the ? icon in the upper-right corner of the screen. This provides a range of new features to help troubleshoot issues with your setup:

  • Diagnostics – This page provides quick access to all the background information our support team needs to know when you report an issue. It contains some basic details about your installation, memory usage, operating system, and so on. This enables you to quickly copy and paste all of this information from one place, rather than having to track it down across your system.
  • Debug – From time to time, the support team may ask you to enable detailed debugging for specific areas of Burp Suite Enterprise Edition. In this case, they will provide a series of values that you should enter on this page. This temporarily increases the level of detail that is included in the logs, which will help our support team get to the bottom of any issues.
  • Support pack – The support team may occasionally ask you to provide a collection of log files to help them troubleshoot an issue that you’ve reported. This page enables you to download various different logs as a single file so that you can easily send them to our support team.

This release also adds the following new options for downloading logs:

  • You can now download the logs for an individual scan. To do this, go to the scan details page for the relevant scan and select “More actions” > “Download scan log”. Note that the log is only available for scans that:
    • Were successfully assigned to an agent
    • Have run or started running since you upgraded to Burp Suite Enterprise Edition 2020.12
    • Are less than 10 days old
  • You can now download the logs for an individual agent machine. To do this, go to the “Agents” page and select the relevant agent machine. In the upper-right corner, click “Download logs”.

Bug fixes

  • When trying to connect to Jira, receiving a response that is larger than 2 MB no longer triggers an exception.
  • In the “Database backup” settings, specifying a save location with dots in the path no longer causes issues. Previously, you would be prevented from saving your changes if you entered a path such as /home/user/example.directory/.
  • When transferring a SQL Server database with the transfer tool, you can now successfully use any target database name. Previously, the transfer would fail if the target name was anything other than burp_enterprise.

Enterprise Edition 2020.11 Release 2020-Nov-16

This release provides a new application logins option that will enable scans to handle single sign-on and other complex login mechanisms. Please note that this upgrade includes some major changes to the GraphQL API as a result.

Recorded login sequences

When adding application logins to a site, instead of simply adding basic sets of user credentials, you now have the option to upload recorded login sequences instead. A recorded login sequence is essentially a script that tells Burp Scanner exactly how to log in to the site. This enables it to handle more complex login mechanisms, including single sign-on.

To generate this script, you use our dedicated Chrome extension to record your browser interactions while you perform the login sequence manually. You then upload this script to the relevant site in Burp Suite Enterprise Edition. When scans of this site begin an authenticated crawl, Burp Scanner will start a new session in its embedded browser and use this script to replicate your actions, performing the full login sequence from scratch.

For more information, please refer to the documentation.

API scanning

Burp Scanner is now able to scan both JSON and YAML-based APIs for vulnerabilities. By default, the crawler attempts to parse any API definitions that it encounters to identify potential endpoints, along with their supported methods and parameters. Based on the endpoints that it discovers, Burp Scanner is then able to derive new locations to crawl and audit.

You can also explicitly provide the URL of an API definition in the list of included URLs for a site.

Please note that this initial release only supports scanning of a fairly limited range of REST APIs. For a full list of the prerequisites and limitations, please refer to the Burp Scanner documentation. We plan to further develop this feature and gradually add support for a wider range of APIs in future releases.

GraphQL API updates

In order to implement the new functionality for uploading recorded login sequences, we’ve had to make some changes to the GraphQL API. These changes may require you to refactor your existing integrations before they will work with this version of Burp Suite Enterprise Edition.

Generally speaking, the entities related to application logins have now been split in two. This is to create the distinction between sets of basic login credentials and recorded login sequences.

The full list of changes is as follows:

  • The type ApplicationLogin is now obsolete. This has been replaced by two new types, LoginCredential and RecordedLogin.
  • The new type ApplicationLogins has been added. This provides two fields, login_credentials and recorded_logins, which contain a list of LoginCredential and RecordedLogin objects respectively.
  • Fields that used to contain a list of the obsolete ApplicationLogin objects now contain a single object of the new type ApplicationLogins. This affects the following fields:
    • The site_application_logins and schedule_item_application_logins fields of Scan objects
    • The application_logins field of Site objects
  • The following mutations are now obsolete:
    • create_site_application_login
    • update_site_application_login
    • delete_site_application_login

    These have been replaced by the following new mutations:

    • create_site_login_credential
    • create_site_recorded_login
    • update_site_login_credential
    • delete_site_login_credential
    • delete_site_recorded_login

Please note that you can add either LoginCredential or RecordedLogin objects to a Site, but not both. Querying the application_logins field for a Site will return a single ApplicationLogins object for which only one of the login_credentials and recorded_logins fields will contain data.

Improved logging

We have improved the logging of certain processes, which should make it easier to troubleshoot any problems that arise. For example, there is now much greater transparency in the log entries when backing up your database. When errors occur with Jira, the log now also provides much more detail about what the problem is.

When a scan check is abandoned due to memory allocation issues, this is now indicated in the scan results, the list of scans, and the downloadable reports. Previously, this would only be mentioned in the event log, which meant that it was easy to miss.

Bug fixes

This release also provides the following bug fixes:

  • The installer now works for users with an external database.
  • The database migration scripts no longer fail when migrating a PostgreSQL or MySQL database on Azure.
  • When the Enterprise server is connected to your SMTP server but cannot connect to portswigger.net, you no longer receive an excessive number of emails about this issue.

Enterprise Edition 2020.10.1 Release 2020-Oct-19

Bug fix

This release fixes a bug in the installer that affected some customers using an Oracle database. Previously, the installer would fail if the database schema name was anything other than burp_enterprise.


Enterprise Edition 2020.10 Release 2020-Oct-15

This release further improves Burp Suite Enterprise Edition’s support for single sign-on by enabling SAML integration. It also provides major improvements to the AWS deployment process.

SAML integration

Burp Suite Enterprise Edition now supports SAML-based single sign-on. This is particularly useful for managing user authentication for cloud-based deployments.

You can integrate SAML SSO using any identity provider (IdP), but the following ones have been fully tested:

  • Active Directory Federation Services (ADFS)
  • Okta
  • Azure Active Directory

To configure the connection to your preferred SAML IdP, log in to Burp Suite Enterprise Edition as an administrator, select “Single sign-on” from the settings menu, then open the “SAML connection” tab.

For more detailed information, please refer to the accompanying documentation.

Other improvements

This release also provides the following improvements:

  • When marking all issues of the same type as false positives, you can now choose to limit this to the current scan only.
  • Empty placeholder pages have been improved. In each case, you will now be informed why the page is empty and prompted to perform the relevant actions to populate it with data.
  • Sites and folders are now displayed in alphabetical order in the site tree.
  • Performance has been improved when running scans that use a large number of scan configurations.

Burp Suite Enterprise Edition on the cloud

This release provides major usability improvements to the deployment process for Burp Suite Enterprise Edition on AWS.

Most notably, the CloudFormation template now creates all of the required AWS infrastructure for you. This includes creating a new Virtual Private Cloud (VPC), so you no longer need to set this up manually. We hope that this will make it much easier to get up and running.

Secondly, there are now two CloudFormation templates for each release of Burp Suite Enterprise Edition:

  • The main template, which is used to create the required AWS environment and deploy the application.
  • The IAM template, which is used to create the relevant IAM users.

Previously, some customers faced issues when the user performing the deployment did not have the appropriate permissions to create IAM users. Now that this is handled in a separate template, you can easily hand over this part of the setup process to the relevant team within your organization.

If you want to deploy Burp Suite Enterprise Edition 2020.10 to the cloud for beta testing, you can download the template for your preferred cloud platform.

Bug Fixes

We have also provided the following bug fixes:

  • Reinstalling Burp Suite Enterprise Edition for use with an existing database no longer causes issues.
  • You can now successfully run the installer over an existing installation, for example, to fix any missing libraries.
  • When the API key is generated for a new API user, long domain names no longer cause the URL to exceed the boundaries of the text field.
  • The option for creating Jira sub-tasks has been removed to avoid invalid issue type errors. Creating sub-tasks is not supported by the Jira API.
  • You can now update the port for your web server’s HTTPS URL without having to upload a new certificate.
  • We have made minor corrections to the GraphQL API reference documentation.

Enterprise Edition 2020.7 Released 2020-Jul-23

This release provides several improvements to our APIs and continues the ongoing improvements to the Burp Suite Enterprise Edition UI.

GraphQL API

We recently released a new GraphQL API to improve the integration of Burp Suite Enterprise Edition with other tools. This release implements the following changes:

  • You can now apply a site_id filter to the scans query. This enables you to fetch all scans for a given site.
  • When fetching issues for a scan, specifying a type_index is now optional. This enables you to fetch all issues for a scan directly. Previously, you first had to fetch the issues grouped by type.
  • We’ve added a new type IssueType, which contains information relevant to a specific issue type, such as a description and remediation advice. Instances of the type Issue now also contain an issue_type field that allows you to fetch this information.

We have also made the following adjustments to the names of some entities:

  • To allow for the new type IssueType, the query issue_types has been renamed to issue_type_groups. Similarly, the existing type IssueType has now been renamed to IssueTypeGroup.
  • For the input object DeauthorizeAgentInput, we have renamed the machine_id field to just id.

REST API

When you apply a custom scan configuration to a scan using the REST API, you can now save it as a named configuration for reuse in future scans. Previously, a custom scan configuration assigned using the REST API would be deleted after the scan was completed.

UI improvements

This release provides more improvements to the Burp Suite Enterprise Edition UI. The placeholder pages that are displayed before you have added a site or run a scan are now much more intuitive.

Bug fixes

We’ve also provided several minor bug fixes, most notably:

  • Active Directory users can now view the scan results by clicking on a scan.
  • Scans that fail to start now appear as failed in the list of scans. This frees up the assigned agent so that you can use it to perform another scan.

Enterprise Edition 2020.6 Released 2020-Jul-7

This release provides major usability improvements and adds support for single sign-on. We are also pleased to announce a beta release for the cloud-native Burp Suite Enterprise Edition on both AWS and Azure.

UI improvements

Over the next few months, we’re working on improving the usability of Burp Suite Enterprise Edition by upgrading the UI. This release includes the first set of these changes:

  • The header menu has been redesigned to make it much easier to navigate. You can now jump straight to the most commonly used parts of the application with a single click.
  • The pages for creating, editing, and viewing both sites and scans have been redesigned to make them much more intuitive.
  • The overall look-and-feel of some screens has been updated. These changes will be rolled out across other parts of the application in upcoming releases.

Single sign-on

You can now configure an LDAP connection between Burp Suite Enterprise Edition and your Active Directory. This enables you to manage your Burp Suite Enterprise Edition users centrally using single sign-on, just like you might already do with other applications.

Once you configure the connection, you simply create user groups in Burp Suite Enterprise Edition that correspond to the groups in your Active Directory. Users can then log in using their existing credentials. User permissions within the application are controlled on the group level, removing the need to create and manage dedicated users for Burp Suite Enterprise Edition.

For more information, please refer to the product documentation.

Burp Suite Enterprise Edition on the cloud

A beta release is now available for deploying Burp Suite Enterprise Edition natively on both AWS and Azure.

Note that you will need a separate Burp Suite Enterprise Edition license for your cloud-based deployment, even if you already have a license for an on-premise installation.

You can use the links below to download the corresponding template for deploying to your preferred platform.


Enterprise Edition 2020.4.3 Released 2020-Jun-3

This release fixes an issue that was causing some customers to see the “Lost communication with Burp Suite” error during scans


Enterprise Edition 2020.4.1 Release 2020-May-18

This release provides several minor bug fixes. Most notably:

  • We have fixed a bug that was causing license key issues for Linux users when upgrading from 2020.2 to 2020.4.
    Note: Unfortunately, if your first installation of Burp Suite Enterprise Edition was version 2020.4, this issue will also occur when you upgrade to 2020.4.1. If you are affected, please contact our Customer Support team for assistance. This will no longer be an issue in future releases.
  • The scan progress is now displayed properly on the sites tree, as well as on the home and folder-level dashboards.

Enterprise Edition 2020.4 Release 2020-Apr-28

GraphQL API

This release provides a beta version of our brand new GraphQL-based API, which exposes most of the core functionality of Burp Suite Enterprise Edition. Among other things, you can use the new API to:

  • Create and edit sites
  • Schedule one-off and regular scans
  • Create and edit custom scan configurations
  • Add folders to your site tree
  • Get scan results and reports
  • Manage your pool of agent machines, including authorizing new agent machines.

You can find more detailed information about how to use the API and the full range of supported operations in the API documentation. This also includes example payloads for typical queries.

As this is a beta version of the API, we would be grateful if customers could inform us of any problems that they encounter so that we can continue to optimize the behavior over the coming months. The Jenkins/TeamCity CI plugins and the generic CI driver will continue to use the existing public REST API. However, we are planning to release additional GraphQL-based versions in the near future.

Note: As a workaround for accessing functionality that was not supported by the public REST API, a small number of customers have integrated their own tools with Burp Suite Enterprise Edition using our internal REST API. Unfortunately, after upgrading to version 2020.4, these integrations will no longer be supported because the internal REST API has largely been replaced. However, you should be able to refactor your integrations to achieve the same results using the new GraphQL API. The vast majority of customers will be unaffected by this issue.

Burp Suite Enterprise Edition in the cloud

This release also marks the start of beta testing for the cloud-native version of Burp Suite Enterprise Edition. Over the next quarter, a small number of customers will be beta testing on both AWS and Azure.

Bug fixes

We have also implemented several minor performance improvements and bug fixes. Most notably, the following issues have been resolved:

  • A null pointer exception is no longer raised when Jira tickets are created automatically using the default severity and confidence settings.
  • Changing the name of a site while using a slower network connection no longer causes errors.

Enterprise Edition 2020.2 released 2020-Feb-12

This release adds a number of new features to help simplify and streamline your post-scan activities. You can now:

  • Choose to download a detailed scan report instead of just a summary.
  • Tailor scan reports to your needs by choosing which severity of issues to include.
  • Specify email addresses that should automatically receive an end-of-scan summary when a scan is completed for a particular site. Note that configuring your email server is a prerequisite for enabling this feature.
  • Download a summary of aggregated issues in CSV format.
  • Automatically create Jira tickets for issues based on their severity and confidence.


Enterprise Edition 2020.1 Released 2020-Jan-13

This release contains a number of valuable enhancements.

There is a new scan configuration library that replicates the Burp Suite Pro feature. You can:

  • View and manage built-in and custom scan configurations.
  • Configure detailed settings for crawling and auditing, as well as platform authentication and upstream proxy settings.
  • Import and export configurations in JSON format.

For each scan, you can now view full details of the individual URLs that were scanned, together with the numbers of issues, requests, and insertion points. You can drill into each URL to view the details of individual issues:

You can now download the scan event log, via the “More actions” button on the scan results page.

There is a new database migration tool that lets you migrate from the bundled database to an external database. See documentation on database migration.

There are various other enhancements and bug fixes:

  • Estimates of scan time remaining are now based on the duration of the preceding scan where applicable.
  • Scans that have not made any progress for 24 hours will be automatically canceled.
  • Issue details can now be retrieved from the aggregated issues list for scans created through the REST
  • API when the site is not saved in the Sites tree.
  • Hover action buttons on the Sites tree are now available for users belonging to groups that have site restrictions configured.

Enterprise Edition 1.1.04 Released 2019-Nov-05

This release includes various enhancements and bugfixes:

  • The page for a folder in the Sites tree now includes a Scans tab, showing scans for all the sites in the selected folder.
  • When creating a new site and selecting the folder to add it to, you can now search for the folder by name.
  • When creating a new scan and selecting the site to scan, you can now search for the site by name.
  • When viewing issues in the aggregated issues view, there is now a preview pane where you can view details of the selected issue, and perform actions such as creating a Jira ticket.
  • A bug that caused Burp Suite Enterprise Edition to leak file handles in some situations has been resolved.

Enterprise Edition 1.1.03 Released 2019-Oct-1

This release adds some new dashboard views.

There is a new site-level dashboard showing various information about the issues that have been found for the site, and its security posture over time. There are new tabs on the site page that let you switch between the dashboard, scan history, issues, and site details:

The sites area has new aggregated issues views. For a selected folder (or for all sites), this view shows all of the issues from the latest scans grouped by issue type. You can expand each aggregated issue to view the details of individual occurrences, and you can filter the view by severity, date, and whether issues are new or regressed:

Various performance improvements have been made. The sites page now loads considerably faster, and large folders are collapsed by default.

Various bugs have been fixed.

In a large organization with many sites and folders, the new folder-level dashboards let you drill down into parts of the organization and understand the vulnerabilities and trends within each area.


Enterprise Edition 1.1.01 Released 2019-Jul-18

This release contains a new database backup feature. This is currently only available when using the internal bundled database (H2).

Automatic backups are enabled by default. The following options can be configured:

  • The number of backups to store.
  • The backup schedule.
  • The location to store backup files (this is configured during installation).

You can also trigger a manual database backup at any time.

A number of minor bugs have also been fixed.


Enterprise Edition 1.1 Released 2019-Jun-28

Burp Suite Enterprise Edition is now officially out of beta!

This release also adds a beautiful new home page dashboard, with various charts showing an at-a-glance view of your overall security posture:

The new charts show:

  • Current issue counts
  • Issue counts over time
  • New and resolved issues over time (deltas between successive scans)
  • Most vulnerable sites
  • Most serious vulnerabilities
  • Recent, running, and upcoming scans

Coming out of beta means we regard Burp Suite Enterprise Edition as essentially stable and suitable for general usage. It doesn’t mean there are no bugs. All software has bugs, and feedback is always welcome about any problems that users observe.

PortSwigger will, of course, be continuing to enhance Burp Suite Enterprise Edition with various new features over the coming months.


Related Post you may be interest

Burp Suite Enterprise Edition Automated Web Scanner

Tagged under: Application Security, Application Security Testing (AST), Burp Suite Enterprise, Dynamic Application Security Testing (DAST)

What you can read next

Mobile Application Development Platform (MADP) Product Overview by E-SPIN
McAfee Server Security Suite Advance Product Overview by E-SPIN
Web Application Security Assessment (WASA) as a Service Product Overview by E-SPIN
Visiwave Wireless Site Survey Technical Overview by E-SPIN
VMware SD-WAN Product Overview Webinar

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent Posts

  • First mover advantage vs second mover advantage

    The first mover advantage and second mover adva...
  • Interactive Disassembler-What is IDA Teams?

    What is IDA Teams? IDA Teams represents the evo...
  • AI and robots role in shaping the future world

    Don’t downplay the significance of the ma...
  • Why Composite AI is so important?

    Example of AIaaS Platforms and its Contributions

    Artificial Intelligence (AI) had become more pr...
  • Information for Business Partners

    At E-SPIN Group, we believe in the power of tea...

Recent Comments

  • JEAN ARIANE H. EVANGELISTA on E-SPIN Wishes all Filipino Araw ng Kagitingan 2022
  • Ira Camille Arellano on E-SPIN Wishes all Filipino Araw ng Kagitingan 2022
  • NKIRU OKEKE on Top 5 Challenges in the Consumer Products Industry
  • Md Abul Quashem on Types of Online Banking or E-Banking
  • Atalay marie on What is Cybersecurity Mesh ?

Archives

  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • March 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • January 2015
  • December 2014
  • October 2014
  • September 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • February 2012
  • July 2011
  • June 2011

Categories

  • Acunetix
  • Adobe
  • Aerospace and Defence
  • AppSec Labs
  • Automotive
  • Banking and Financial Markets
  • Brand
  • Case Studies
  • Cerbero Labs
  • Chemical and petroleum
  • Codified Security
  • Commercial and Professional Services
  • Construction and Real Estate
  • Consumer products
  • Contact Us
  • Core Impact
  • Core Security
  • DBeaver
  • DefenseCode
  • DSquare Security
  • DSquare Security
  • E-Lock
  • Education
  • Electronics
  • Energy and utilities
  • Excelledia
  • FAQ
  • Food and Beverage (F&B)
  • GFI
  • GitLab
  • Global Themes and Feature Topics
  • Government
  • HCL
  • Healthcare
  • Hex-Rays
  • IBM
  • Immunity
  • ImmuniWeb
  • Industries
  • Information Technology
  • Insurance
  • Invicti
  • Ipswitch
  • Isorobot
  • JetBrains
  • Job
  • Life Science
  • LiveAction
  • Magnet forensics
  • Manufacturing
  • McAfee
  • Media and Entertainment
  • Metageek
  • Micro Focus
  • Microsoft
  • Mining and Natural Resources
  • Nessus
  • Netsparker
  • News
  • Nutanix
  • Paessler
  • Parasoft
  • PortSwigger
  • Pradeo
  • Product
  • Progress
  • Rapid7
  • RedHat
  • Retail
  • Retina
  • Riverbed
  • RSA
  • SecHard
  • Security Innovation
  • Security Roots
  • Services
  • SILICA
  • Soft Activity
  • SolarWinds
  • Solution
  • SUSE
  • Symantec
  • TamoSoft
  • Telecommunications
  • Tenable
  • Titania
  • Transportation
  • Travel
  • Trend Micro
  • Trustwave
  • TSFactory
  • UBsecure
  • Uncategorized
  • Vandyke
  • Veracode
  • Videos
  • VisiWave
  • VMware
  • Webinar Archive

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

CORPORATE

  • Profile
  • About us
  • Investor Relations
  • Procurement

SOLUTIONS & PRODUCTS

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services
  • Case Studies

STORE & SUPPORT

  • Shop
  • Cart
  • Checkout
  • My Account
  • Support

PRODUCTS & SERVICES

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services
  • Case Studies

FOLLOW US

  • Facebook
  • Twitter
  • Pinterest
  • LinkedIn
  • YouTube
  • WordPress Blog
© 2005 - 2022 E-SPIN Group of Companies | All rights reserved.
E-SPIN refers to the global organisation, and may refer to one or more of the member firms of E-SPIN Group of Companies, each of which is a separate legal entity.
  • Contact
  • Privacy
  • Terms of use
TOP