GAP (Get All Parameters, Links, and Words)
Summary: PortSwigger's BApp Store lists a Burp extension called GAP (Get All Parameters, Links, and Words), version 6.2.0, by author XNL-h4ck3r, last updated 07 January 2026. The extension collects all parameter names observed during scanning or manual testing into a dedicated tab, to help identify hidden, undocumented, or parameter pollution opportunities across a target application.
Why it matters: Parameter pollution and undocumented parameters are the kind of input surface that rarely shows up in a spec or a threat model, and this tool exists because testers need a running inventory of every name the application actually accepts. PortSwigger states it makes no warranty about the quality or usefulness of third-party extensions for any particular purpose, so the decision to run one sits with your team.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026