Introducing HTTP Anomaly Rank

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/introducing-http-anomaly-rank
• Blog Title: Introducing HTTP Anomaly Rank
• Suggested Section: Generic Methodologies & Resources > Pentesting Methodology (add a subsection: Web fuzzing result triage with Burp/Turbo Intruder Anomaly Rank)

🎯 Content Summary

What
HTTP Anomaly Rank is a response-triage algorithm by PortSwigger (announced November 11, 2025, 14:41 UTC) that automatically prioritizes anomalous HTTP responses. It is integrated into Turbo Intruder and exposed via the Burp Suite API in release 2025.10, making it suitable for large result sets and AI-driven features.

Why
Manually sorting Intruder/...

🔧 Technical Details

Stability-weighted diffing for large response sets: Compute many attributes per response (status, content type, word/line counts, CRC32, exact byte sequences). Assign each attribute a weight from its stability across the batch: few unique values → high weight; invariant or per-response-unique → near-zero. Compare responses only on these weighted, stable attributes to reduce noise and highlight meaningful differences.

Rarity-driven anomaly scoring: For each response, sum contributions from attributes where the response’s value is rare, scaled by that attribute’s stability weight. Responses with rare values on highly stable attributes rank highest, quickly revealing authz edges, error paths, or input-handling quirks (e.g., a lone 200 among 403s, or an off-by-one word count).

Efficient triage workflow: Defer computation until batch completion to save CPU during bursts, then auto-sort by the anomaly score. Manually override with table.setSortOrder(...

🤖 Agent Actions

I analyzed the blog and HackTricks repository and added the technique where it best fits: the Web Methodology page that already covers web discovery, brute-forcing, and vulnerability checks. The new content documents how to triage large fuzzing/bruteforce result sets using Burp/Turbo Intruder’s HTTP Anomaly Rank, including algorithm internals, a worked example, and practical usage guidance.

What I did

• Read relevant files to find the best location:
  • src/generic-methodologies-and-resources/pentesting-methodology.md
  • src/network-services-pentesting/pentesting-web/README.md
  • src/pentesting-web/race-condition.md
  • src/pentesting-web/http-request-smuggling/README.md
  • src/pentesting-web/idor.md
• Decided the most relevant and discoverable place is the Web Methodology page (not the top-level generic methodology), right after the brute-force section where users need triage guidance the most.
• Updated a single file:
  • src/network-services-pentesting/pentesting-web/README.md
    • Added a new section: “Web fuzzing result triage with Burp/Turbo Intruder Anomaly Rank”
      • Stability-weighted diffing approach: attribute extraction, stability weighting, per-response scoring
      • Worked example table and reasoning
      • Why it works on noisy pages
      • Practical notes: O(N) complexity, computation at attack completion, update to Burp 2025.10+ if Anomaly Rank shows 0, override sorting via table.setSortOrder(), triage tips (single 200 amidst 403s, off-by-one word/line counts)
    • Added a “## References” section at the end (above the banner), including:
      • Introducing HTTP Anomaly Rank
      • Turbo Intruder research page
      • Backslash Powered Scanner research
      • Demo video

Why here and not in Generic Methodology

• The technique is highly specific to web fuzzing/Intruder workflows and belongs in the web methodology where users already perform brute-forcing, discovery, and mass requests. This makes it immediately actionable and avoids duplicating generic guidance.

Notes

• If users see the “Anomaly Rank” column but values are always 0, they must update Burp Suite to 2025.10+.
• Turbo Intruder auto-sorts by Anomaly Rank on completion; custom ordering can be applied via table.setSortOrder() if desired.

Changes committed

• Modified: src/network-services-pentesting/pentesting-web/README.md
  • Added the triage subsection and references as described above.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 907
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/introducing-http-anomaly-rank

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Pentesting Methodology (add a subsection: Web fuzzing result triage with Burp/Turbo Intruder Anomaly Rank)".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0