RRE-BURP

Summary from the TLDR InfoSec newsletter

The RRE Burp extension automates detecting Recursive Request Exploits by tracing API call chains from protected resources to find unauthenticated upstream APIs exploitable to bypass access controls. It uses Shannon entropy analysis (default threshold 3.0) to identify valuable backend tokens and parameters, then traces requests to find low-trust inputs that produce these high-value outputs. Demonstrated at DEF CON 33, it scales to find vulnerabilities across streaming services ("Streamageddon"), revealing how API chain flaws can bypass paywalls.