PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hunting asynchronous vulnerabilities

portswigger.net | research | #burp-collaborator | #oast | #vulnerability-hunting | #asynchronous | #callbacks
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle introduces callback-based hunting for asynchronous vulnerabilities, from blind second-order SQLi to shell injection in background jobs, via exploit-induced callbacks. The basis of OAST.
Published
Collected

Related coverage

blog · portswigger.net
A modern, elastic design for Burp Collaborator server
PortSwigger re-architected the public Burp Collaborator server with a cloud-native, elastic design using load balancers and Redis, replacing the old in-memory monolith to handle surging OAST traffic.
blog · portswigger.net
The history of OAST in Burp Suite
A retrospective on six years of OAST in Burp Suite: Burp Collaborator's 2015 debut made out-of-band testing accessible, powering reliable detection of blind SQLi, blind XSS and similar flaws.
blog · portswigger.net
OAST (Out-of-band Application Security Testing)
Dafydd Stuttard argues OAST (Out-of-band Application Security Testing) belongs alongside DAST, SAST, and IAST, crediting Burp Collaborator with mass-market zero-config out-of-band detection.
blog · portswigger.net
Introducing Burp Collaborator
Burp Suite introduces Burp Collaborator, an external service for detecting out-of-band interactions, enabling discovery of super-blind injections, blind XSS, SSRF, and asynchronous code injection.
research · portswigger.net
Hunting evasive vulnerabilities
James Kettle's Nullcon keynote explores evasive vulnerabilities from a decade of research — too advanced, too silly or well-masked to spot — extracting principles for finding overlooked flaws.
research · portswigger.net
How I accidentally framed myself for a hacking frenzy
James Kettle recounts how Collaborator Everywhere made servers vulnerable to X-Forwarded-For spoofing misattribute attacks to burpcollaborator.net, triggering abuse reports.
Back