Wouldn't this also be vulnerable to dns rebinding attacks?

I only have one ticket! I am not the worst 🤣

You would have kept it if it was called activity logs 🥹 Probably an ego boost would be a better name for these activities though 🥲

I wonder if burp itself can do something for jython extensions since it has access to the location of a jython jar file to share it with extensions. But even with that I need to see how jython can use montoya 🥲

Do we need to include the jython jar file in it? forum.portswigger.net/thread/are-j...

I always thought jython cannot use montoya. Is this a hackvertor hack or it's been always possible?

As always, also thanks to @albinowax and @PortSwigger for keeping the top 10 flame alive for another year!

You are right. Unfortunately it's a cruel one especially when there is no sponsor. Most researchers also just use it with not much contribution which is ok but sad.

📌