PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Behind enemy lines: bug hunting with Burp Infiltrator

portswigger.net | blog | #jetbrains | #teamcity | #collaborator | #iast | #burp-infiltrator | #0day | #bug-hunting
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Santiago Díaz demonstrates using Burp Infiltrator to uncover a 0day in JetBrains TeamCity, with Collaborator pingbacks exposing user input reaching dangerous sinks and revealing the code path.
Published
Collected

Related coverage

blog · portswigger.net
Introducing Burp Infiltrator
Burp Infiltrator instruments Java and JVM-based applications by patching bytecode with hooks on unsafe APIs, pinging Burp Collaborator when scanner payloads reach them — an IAST-style capability.
Critical · vulnerability · github.com
CVE-2026-63077: JetBrains TeamCity unauthenticated RCE with public PoC and active exploitation
An unauthenticated attacker who can reach a TeamCity HTTP(S) service may execute arbitrary operating-system commands with the TeamCity server process privileges, exposing configuration and credentials, changing server state, and compromising build artifacts or downstream CI/CD pipelines. CISA KEV now confirms active exploitation. Upgrade to 2025.11.7, 2026.1.3, or later immediately; if upgrading is not possible, apply JetBrains' security patch plugin, restrict internet access, rotate exposed credentials, and investigate potentially exposed instances.
vulnerability · wiz.io
Authentication bypass vulnerabilities in TeamCity: everything you need to know
JetBrains patches TeamCity authentication bypass flaws—CVE-2024-27198 (CVSS 9.8) and CVE-2024-27199 (CVSS 7.3); unauthenticated attackers can take full control, with exploitation seen in the wild.
blog · portswigger.net
BChecks: Houston, we have a solution!
PortSwigger launches BChecks in beta for Burp Suite Professional, a scripting language with conditional logic, regex, raw HTTP requests, and Collaborator support for custom scan checks.
blog · portswigger.net
Enterprise Edition: CI integration
Burp Suite Enterprise Edition integrates with CI/CD via a REST API, native Jenkins and TeamCity plugins, and a generic CLI driver, letting builds trigger scans and fail on reported issues.
blog · portswigger.net
OAST (Out-of-band Application Security Testing)
Dafydd Stuttard argues OAST (Out-of-band Application Security Testing) belongs alongside DAST, SAST, and IAST, crediting Burp Collaborator with mass-market zero-config out-of-band detection.
Back