PortSwigger Introduces HTTP Anomaly Rank for Automated Response Analysis
PortSwigger Research has introduced HTTP Anomaly Rank, a new algorithm designed to streamline the analysis of HTTP responses in security testing tools like Burp Intruder and Turbo Intruder. Traditionally, security researchers manually sort thousands of responses by length or status code to identify anomalies. This new algorithm automates the process by scoring responses based on their deviation from the norm, effectively highlighting the most interesting findings without manual intervention. Developed by James Kettle, the algorithm evolved from earlier diffing logic used in the Backslash Powered Scanner. It calculates attribute stability, such as status codes and word counts, to assign uniqueness scores, allowing it to detect subtle discrepancies even in noisy data. The feature is now integrated into Turbo Intruder, automatically sorting results upon attack completion, and is available via the Burp Suite API in release 2025.10. This integration aims to reduce user effort and supports the development of AI-based security features by efficiently sifting through massive result sets with O(N) computational complexity.
Wire timeline
PortSwigger Introduces HTTP Anomaly Rank for Automated Response Analysis
PortSwigger Research has introduced HTTP Anomaly Rank, a new algorithm designed to streamline the analysis of HTTP responses in security testing tools like Burp Intruder and Turbo Intruder. Traditionally, security researchers manually sort thousands of responses by length or status code to identify anomalies. This new algorithm automates the process by scoring responses based on their deviation from the norm, effectively highlighting the most interesting findings without manual intervention. Developed by James Kettle, the algorithm evolved from earlier diffing logic used in the Backslash Powered Scanner. It calculates attribute stability, such as status codes and word counts, to assign uniqueness scores, allowing it to detect subtle discrepancies even in noisy data. The feature is now integrated into Turbo Intruder, automatically sorting results upon attack completion, and is available via the Burp Suite API in release 2025.10. This integration aims to reduce user effort and supports the development of AI-based security features by efficiently sifting through massive result sets with O(N) computational complexity.
PortSwigger Research