PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Burp, Collaborate, and Listen: A Pentester Reviews the Latest Burp Suite Addition

bishopfox.com | blog | #pentesting | #burp-suite | #tools | #collaborator | #blind-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A pentester's review of Burp Suite's Collaborator: how out-of-band HTTP and DNS callbacks surface super-blind injection points, when to host a private server, and VPS trade-offs.
Published
Collected

Related coverage

blog · netspi.com
DNS Tunneling with Burp Collaborator
A Burp Suite extension built on the Collaborator API automates DNS tunneling, with Bash and PowerShell scripts to base32-encode and chunk data out of restricted networks, needing a private server.
blog · bishopfox.com
How to Set Up Your Hardware Lab
Jordan Parkin shares how Bishop Fox equipped its hardware lab for product security reviews, recommending soldering, desoldering and test gear for device research on various budgets.
blog · bishopfox.com
The Pen Testing Tools We’re Thankful for This Season
Bishop Fox consultants name the pen testing tools they're most thankful for in 2019 — TKO-SUBs, BloodHound, Impacket, and Frida among them — with use cases and install notes.
blog · bishopfox.com
How We Can Stop Email Spoofing
Bishop Fox scanned the Alexa top million domains and found 98% vulnerable to email spoofing; only 2% combined SPF with strict DKIM. The free SpoofCheck tool diagnoses missing defenses.
blog · bishopfox.com
A Guide to Choosing the Right VPN
A practical guide to choosing a VPN: after testing a range of providers, Bishop Fox breaks down the strengths and weaknesses of its top five picks and warns about the shadier record of free VPNs.
blog · bishopfox.com
Quick Intro to NotInMyBackYard Diggity
An introduction to NotInMyBackYard Diggity, part of Bishop Fox's SearchDiggity suite: prebuilt Google and Bing queries hunt leaked sensitive data on Pastebin, YouTube, Twitter and cloud storage sites.
Back