Professional 1.7.25
Summary: PortSwigger released new Burp Scanner checks based on its Black Hat talk "Cracking the lens: targeting HTTP's hidden attack surface," which place Collaborator-based payloads in locations aimed at inducing applications and infrastructure to route requests to a different destination. The research behind the checks netted over $30,000 in bug bounty payouts and demonstrates the power of out-of-band application security testing (OAST).
Bottom line: The same request-routing weakness the checks target can produce SSRF against the application server itself or other infrastructure components, and the $30,000 in payouts shows how much of it was sitting undiscovered in production.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026