Burp Suite tips from power user and "hackfluencer" Stök
Summary: PortSwigger published tips from Stök, a content creator with over 25 years in IT who learned Burp Suite through HackerOne co-founder Jobert Abma in a Goa hotel room and later earned his first bounty on a race condition using Burp Suite Professional. His advice includes hosting his own Burp Collaborator instance because the main collaborator domain is often blocked by targets, using null payloads in Burp Intruder to test for race conditions, and relying on BApp extensions such as Turbo Intruder, Taborator, and Autorize.
Bottom line: Stök's point that the default Collaborator domain is often blocked by targets is a reminder that out-of-band testing depends on infrastructure the target hasn't already blacklisted - a detail that decides whether blind vulnerabilities get found at all.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026