How to build custom scanners for web security research automation
Summary: PortSwigger Director of Research James Kettle describes building a custom Burp Suite extension that sends a request ten times sequentially and then ten times in under 1ms using the single-packet attack, reporting any difference in status code to probe for web race conditions. He tested it against a project file of roughly 30,000 bug bounty websites, and after filtering out cache-poisoning false positives, found a site where a race condition exposed the URLs live users were accessing via the homepage.
What's compelling: The approach deliberately favors false positives over false negatives and skips the 'predict' phase of manual testing, so the output is a flood of leads that only becomes useful after manual triage is itself automated. The payoff case - reading other users' URLs from a homepage fetch - is the kind of infoleak that a standard scanner tuned to avoid noise would never report.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026