Using recursive grep for harvesting data
Summary: PortSwigger's Dafydd Stuttard explains that Burp Intruder's "recursive grep" payload source generates each attack payload from the application's response to the previous request, unlike other payload sources. He walks through using it against an MS-SQL SQL injection bug that returns one value at a time: the first request sends 'a', each later request sends the username extracted from the prior error message, and the full username table is dumped within seconds.
What you should know: A single-value SQL injection that looks slow to exploit by hand can be turned into a full table dump in seconds once the tooling feeds each response back in as the next payload - so an injection point that leaks one row per request is not a limited exposure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026