Introducing Burp Collaborator
Summary: PortSwigger's release of Burp Suite introduces Burp Collaborator, an external service distinct from Burp and the target application that detects issues the conventional testing model misses, including blind XSS, server-side request forgery, and asynchronous code injection. The design relies on payloads containing a random subdomain of the Collaborator domain, where a DNS lookup alone is sufficient to report an issue, and each payload carries a unique one-time random identifier so deferred interactions can be traced back to the original request, insertion point, and full payload.
Why it matters: The Collaborator server records interactions from a random identifier but does not see the HTTP request Burp sent to the target, so in most cases it lacks enough information to identify the vulnerability - a distinction that matters when deciding how much testing infrastructure sits outside your own perimeter.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026