Shadow Repeater:AI-enhanced manual testing

Summary: PortSwigger released Shadow Repeater, a Burp Suite Professional extension that monitors Repeater requests, identifies the parameters a tester is changing, and sends the extracted payloads to an AI model to generate variants, which it then sends to the target and checks with response diffing. By default it activates on the fifth Repeater request and requires a parameter or header to have changed, reporting findings through Organizer; it is available on the BApp store and its source code is on GitHub.
What's compelling: The tool's response diffing, built on code samples from the developer of Backslash Powered Scanner, surfaced results including spaces being allowed in an XSS vector, working path traversal vectors, and unknown vulnerabilities such as email splitting attacks - findings a manual tester missed by a single flawed choice in syntax, encoding, or file path.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026