Look Over There
Summary: PortSwigger Research describes a Burp Suite extension called Look Over There, created by Felix Ryan, that takes a trigger URI and a target URI and, when the trigger URI is observed, inserts an HTTP 302 status code and a Location header pointing to the target URI. The extension is aimed at Single Page Applications with JavaScript-facing APIs, and it only operates on requests made by appropriate Burp Suite tools, doing nothing for requests triggered by Proxy, Spider, Sequencer, Decoder, or Comparer.
What you should know: The extension exists to cut manual testing effort on SPAs whose APIs interact with JavaScript, and it works by getting Burp to follow a redirect so it can see successful attack results - a reminder that scanner coverage on JavaScript-heavy applications depends on steering the tool to the right endpoints.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026