Type Confusion Scanner
Summary: A Burp Suite extension called Type Confusion Scanner, authored by certuscyber and last updated 11 September 2023, resubmits any JSON body in an HTTP request with integer and boolean values replaced by their string equivalents. If the server returns a successful response to the altered types, the extension treats that as an indication that variable types are not being checked server-side.
Key Takeaway: The check rests on a single signal - a successful response to a type-swapped request - so a server that accepts a string where it expected an integer is flagged as unvalidated, and that gap is what the extension exists to surface.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026