Reflected Parameters
Summary: PortSwigger's BApp Store lists a Burp Suite extension called Reflected Parameters, written by Marek Zmyslowski at version 0.26 and last updated 10 November 2014, which monitors in-scope Proxy and Spider traffic for request parameter values longer than 3 characters that appear in the response. Reported items can be sent to other Burp tools, including the Scanner, where the user chooses whether to scan all reflected parameters or just one, and it requires Java version 7.
Key Takeaway: The extension flags any reflected parameter longer than 3 characters, so the triage decision it forces - scan all reflected parameters or only one - determines how much of each response's reflection surface actually gets tested.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026