Shadow Repeater
Summary: PortSwigger Research describes Shadow Repeater, a Burp extension by Gareth Heyes that runs alongside Burp Repeater and automatically mutates the inputs a tester sends, then analyzes responses for anomalies and reports findings through Organizer. The extension is aimed at probing for path traversal, SQL injection, XSS and other vulnerabilities, and is listed at version 1.2.3 with a last update of 18 November 2025.
What you should know: The tool's stated purpose is surfacing bypasses and alternative attack vectors that manual testing would otherwise miss, which means the same automated variation testing it gives your testers is available to anyone probing your applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026