PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shadow Repeater:AI-enhanced manual testing

portswigger.net | research | #ai-security | #burp-suite | #automation | #fuzzing | #security-testing | #tooling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shadow Repeater adds AI-powered variation testing to manual testing: it monitors Repeater requests, generates payload variants and uses response diffing to catch near-miss bugs like unusual XSS.
Published
Collected

Related coverage

research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
research · portswigger.net
Adapting Burp extensions for tailored pentesting
James Kettle shows how to customize open-source Burp extensions for tailored pentesting, modifying Collaborator Everywhere to inject SSRF-prone parameters found via Bugcrowd's HUNT.
Back