Collaborator Everywhere
Summary: A Burp Suite extension called Collaborator Everywhere inserts Burp Collaborator payloads into all HTTP headers and URL parameters of in-scope traffic during active testing, aimed at uncovering SSRF and blind RCE. Version 2.0.3, authored by Andreas Brombach of Compass Security and James Kettle, is an improved version of Kettle's original Collaborator Everywhere and was last updated 29 August 2025.
What's compelling: The tool exists because out-of-band vulnerabilities like SSRF and blind RCE hide in entry points that manual injection would miss or take too long to cover, so testing every header and parameter becomes the practical baseline.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026