Repeater Strike: manual testing, amplified
Summary: PortSwigger researcher Gareth Heyes released Repeater Strike, an experimental AI-powered Burp Suite extension that analyzes Repeater traffic to generate regular expressions and then applies them across proxy history to find IDOR and similar vulnerabilities. Generating a Strike Rule cost 61 AI tokens, with no further token use once the rule exists, and the tool requires the Early Adopter channel and is described as far from a finished product.
What you should know: The tool turns a single manually confirmed finding into a sweep of your entire proxy history, but Heyes reports the AI sometimes failed to escape regex metacharacters and that generalizing patterns across different sites proved hard - so a rule built on one target may not hold on another.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026