Improved detection of stored input
Summary: PortSwigger Research says Burp Scanner can already detect when an application stores input from one request and returns it in another response, then checks for second-order issues such as SQL injection and cross-site scripting. The company states its current capability has two key limitations, which a new multi-phase scanning model largely removes by splitting active scanning into distinct phases, each completed for all items before the next begins.
Key Takeaway: Stored input that resurfaces in a later response is where second-order SQL injection and cross-site scripting hide, and the phased model reduces the chance that stored data is overwritten by other activity before it is observed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026