PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Repeater Strike: manual testing, amplified

portswigger.net | research | #ai-security | #burp-suite | #automation | #idor | #security-testing | #tooling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Repeater Strike is an AI-powered Burp extension that analyses Repeater traffic, generates smart regexes for bugs like IDOR and scans proxy history to turn one finding into many actionable results.
Published
Collected

Related coverage

blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
research · portswigger.net
Adapting Burp extensions for tailored pentesting
James Kettle shows how to customize open-source Burp extensions for tailored pentesting, modifying Collaborator Everywhere to inject SSRF-prone parameters found via Bugcrowd's HUNT.
research · portswigger.net
Burp Clickbandit: A JavaScript based clickjacking PoC generator
PortSwigger releases Burp Clickbandit, a pure-JavaScript point-and-click tool that generates clickjacking proof-of-concept attacks, including multi-click attacks, directly from within Burp.
Back