Identifying reflected input with Burp Suite - Port Swigger
Summary: PortSwigger describes reflected input as data copied from a request and echoed into an application's immediate response, calling it a prerequisite for vulnerabilities including reflected cross-site scripting. The guidance covers using Burp Scanner in Burp Suite Professional to flag reflected input in the Issues tab, and using the text editor search function to check whether a unique string appears in the response.
Why it matters: Reflected input is the precondition for reflected XSS, so any request parameter that echoes back into the response is a candidate attack surface a security leader should expect their testing program to catch.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026