The history of OAST in Burp Suite
Summary: PortSwigger introduced Burp Collaborator in 2015 to make out-of-band (OAST) testing easier, and six years later its automated component runs inside Burp Scanner without many users noticing. The company says the tool now supports detection of blind SQL injection, blind XSS, asynchronous SQL injection, blind SSRF, and deferred asynchronous command injection, with blind server-side template injection listed as a pending addition.
Bottom line: PortSwigger states that a sizable chunk of the blind and asynchronous vulnerabilities flagged in Burp Scanner's results would not appear without Burp Collaborator, and that OAST rarely produces a false positive - so any team relying on scan output without out-of-band testing is likely missing a class of findings entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026