PortSwigger Releases Shadow Repeater: AI-Enhanced Manual Testing Tool
PortSwigger Research has officially released Shadow Repeater, a new extension for Burp Suite Professional designed to enhance manual security testing with artificial intelligence. Published on February 20, 2025, this tool addresses the common issue of missed vulnerabilities caused by minor syntax errors or flawed choices during manual penetration testing. Shadow Repeater operates automatically in the background, monitoring user requests in Burp Repeater to identify changed parameters. It extracts payloads and utilizes an AI model to generate diverse variations, such as alternative encodings or file paths. The system then executes these variations against the target and employs response diffing logic to detect significant differences that indicate potential vulnerabilities like XSS, path traversal, or email splitting. Unlike previous attempts that analyzed entire requests, this approach focuses only on changing values, improving efficiency and accuracy. The tool integrates seamlessly into existing workflows without requiring significant changes, reporting findings via the Organizer tab. Developed by researcher Gareth Heyes after refining concepts from AI Hackvertor, Shadow Repeater is now available on the BApp store and GitHub, offering security professionals a powerful method to uncover unexpected behaviors and novel vulnerabilities through automated, AI-driven permutation testing.
Wire timeline
PortSwigger Releases Shadow Repeater: AI-Enhanced Manual Testing Tool
PortSwigger Research has officially released Shadow Repeater, a new extension for Burp Suite Professional designed to enhance manual security testing with artificial intelligence. Published on February 20, 2025, this tool addresses the common issue of missed vulnerabilities caused by minor syntax errors or flawed choices during manual penetration testing. Shadow Repeater operates automatically in the background, monitoring user requests in Burp Repeater to identify changed parameters. It extracts payloads and utilizes an AI model to generate diverse variations, such as alternative encodings or file paths. The system then executes these variations against the target and employs response diffing logic to detect significant differences that indicate potential vulnerabilities like XSS, path traversal, or email splitting. Unlike previous attempts that analyzed entire requests, this approach focuses only on changing values, improving efficiency and accuracy. The tool integrates seamlessly into existing workflows without requiring significant changes, reporting findings via the Organizer tab. Developed by researcher Gareth Heyes after refining concepts from AI Hackvertor, Shadow Repeater is now available on the BApp store and GitHub, offering security professionals a powerful method to uncover unexpected behaviors and novel vulnerabilities through automated, AI-driven permutation testing.
PortSwigger Research