Functional PoCs in less than a minute? Julen Garrido Estévez puts Burp AI to the test
Summary: Pentester Julen Garrido Estévez tested Burp AI in Repeater against PortSwigger Web Security Academy labs, the deliberately vulnerable ginandjuice.shop, and his own environments, logging each interaction as a reproducible test case covering time to PoC, request count, hallucinations, and credits consumed. In two lab walkthroughs, Burp AI produced a working SSTI proof-of-concept in 18 requests over 44 seconds for about €0.43, and cracked a PHP object deserialization flaw to gain admin access in four requests and 61 seconds for roughly €0.34.
What's compelling: An AI co-pilot that turns a reflected parameter into a functional exploit in under a minute for less than half a euro compresses the window between a lead and a working attack - and the same speed is available to anyone probing your applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026