Cyber Risks · PortSwigger Research

Multi Session Replay

Summary: PortSwigger's BApp Store lists Multi Session Replay, a Burp Suite extension by Michal Talecki at version 0.6.2, last updated 03 October 2017, that replays requests across multiple sessions. Its stated main purpose is to aid in searching for privilege escalation issues, and PortSwigger notes the extension is written by a third party and makes no warranty about its quality or usefulness.

Bottom line: Privilege escalation is the class of bug that turns a low-privilege account into an admin one, and this tool exists specifically to replay the same request across sessions to surface it - a reminder that authorization flaws hide in the gaps between user contexts your testing may not be exercising.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related