Getting started with Burp Collaborator - Port Swigger
Summary: PortSwigger's tutorial walks through manually using Burp Collaborator to test whether a target site can be induced to make a request to an arbitrary server, by inserting a Collaborator payload into the Referer header of a GET /product?productId request and sending it from Repeater. Collaborator polls for interactions every 60 seconds, and the resulting HTTP and DNS interactions confirm the target made the request, demonstrating a blind SSRF proof of concept.
Key Takeaway: The technique produces a working proof of concept for blind SSRF without any visible response from the target - the only evidence is an out-of-band interaction your monitoring may never correlate to the request that caused it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026