Document My Pentest: you hack, the AI writes it up!
Summary: PortSwigger researcher Gareth Heyes released "Document My Pentest," an open-source Burp Suite extension that watches requests in real time and uses AI to build a structured record of a penetration test, generating notes from Repeater or proxy history. Heyes reported the AI struggled to analyze whole requests and responses for issues like XSS but worked well on Path Traversal with clear directory listings, so he built an input-to-regex translator to match reflected input and used a separate whole-request prompt for cases like Request Smuggling.
What's compelling: Heyes found the AI misidentified vulnerabilities as potential XSS even when input was HTML encoded, and only reduced false positives after rewriting prompts with more precise language and having the LLM critique its own output - a reminder that an AI-assisted triage tool inherits every ambiguity in its instructions.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026