Collaborator settings - Port Swigger
Summary: PortSwigger's documentation for Burp Collaborator settings explains that Collaborator is an external service Burp uses to discover vulnerabilities such as external service interaction and out-of-band XSS. The public Collaborator server currently uses the domains *.burpcollaborator.net or *.oastify.com, and PortSwigger says it periodically adds new domain names to reduce the chance of WAF blacklisting that causes false negatives.
Why it matters: If your WAF blacklists the Collaborator domains, out-of-band findings turn into false negatives, so the machine and target application need access to both domains on ports 80 and 443.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026