Burp AI in Repeater - Port Swigger
Summary: PortSwigger added Burp AI, an on-demand assistant inside Burp Repeater that analyzes, understands, and tests HTTP messages, and in one described case it identified the parameter controlling object access, substituted leaked user IDs in a series of requests, confirmed some returned other users' data, and summarized the IDOR for reporting. Each task runs as reviewable steps with a Logger tab recording all requests and responses, and Burp AI does not retain conversation history, so all context must be included in each prompt.
What's compelling: The assistant can construct and fire a series of requests that confirm access to other users' records, so the volume and speed of IDOR-style probing against your applications no longer depends on a tester doing it by hand. Because it keeps no conversation history and runs on any Repeater tab with a specified target, the record of what was tested lives in your project file and logs, not in the tool.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026