#burpai — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #burpai, aggregated by home.social.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.
-
Having had a cursory glance at Burp AI, there is just an instant dealbreaker: you have no control which requests it sends to your target.
Let's say you tell it "find a RCE in this parameter", nothing stops it from injecting "rm -rf /*" or exfiltrating all ssh keys to pastebin because it learned that from some weird medium blog post or CTF write up.
Not being able to review the requests before they are fired is insane.You might say, an active scan also does that. Sure, but they are curated and static. The payloads won't just change every minute.