---
id: 5546
title: "Hunting asynchronous vulnerabilities"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/hunting-asynchronous-vulnerabilities"
published_at: "2023-02-06T14:22:00Z"
tags: ["burp-collaborator", "oast", "vulnerability-hunting", "asynchronous", "callbacks"]
phying_url: "https://phying.com/item/5546"
lang: en
---

# Hunting asynchronous vulnerabilities

## Summary

James Kettle introduces callback-based hunting for asynchronous vulnerabilities, from blind second-order SQLi to shell injection in background jobs, via exploit-induced callbacks. The basis of OAST.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-02-06T14:22:00Z
- **Original:** https://portswigger.net/research/hunting-asynchronous-vulnerabilities
- **Phying News:** https://phying.com/item/5546