Custom actions writing guide - Port Swigger
Summary: PortSwigger published a reference guide for writing custom actions, which are scripts that run directly in Burp Repeater to automate tasks and extract information during manual testing. The guide covers seven Montoya API objects, including HttpRequestResponse, RequestResponseSelection, and Ai, and walks through use cases such as decoding data, sending modified requests, testing for race conditions with the single-packet attack, and running shell commands.
Why it matters: The guide warns that dangerouslyExecute() passes an entire string to a shell and can be exploited for command injection, so user input must only ever be passed as separate arguments to execute() with the command hard-coded. A testing script built on user-controlled input is itself an attack surface inside the tester's own environment.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026