Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp Collaborator Results & Errors

xEvVaYHw3DRY9Q | Last updated: Aug 02, 2017 01:59AM UTC

Hi all, I was checking this one app, where, while using Collaborator feature, I noticed a seemingly inconsistent behavior. The app is protected by Cloudflare, and it is possible that WAF is also in use. I am using Burp's public collaborator server, and the Collaborator Everywhere extension. One of the scans was able to confirm External service interaction (DNS & HTTP) finding. The requests for both of these originated from 2 different IP addresses (CloudFlare), which are different servers than the web app. There are 2 issues I am trying to figure out: 1. When replicating these tests manually, no response is received back even if I use the same payloads(.burpcollaborator.net) urls. I have tested the reported url/request, and multiple others, but the response is not received. In some cases, a different set of cloudflare IPs are seen to reset the connection attempts Q: How can I test the reported url manually? And is it possible to explicitly send the requests via CloudFlare IP addresses seen initially? 2. While trying out different requests, and payload formats, and even performing Active Scans with 'External / Out of Band Interaction' scan option, there is no positive response received (i.e. confirmation from burp collaborator, as shown through Collaborator Everywhere). However, I find that there are continuous Alerts being received during these tests. The message is: The Burp Collaborator server used by the Burp Collaborator client is not reachable, change the settings to use this feature. I have run the Health check for Collaborator and all tests are green. I have also checked the request & response logs for Extender traffic, and it does not show anything relevant. And Alert count keeps going up. Q: Are these known issues / false positives? Is it possible to dig deeper into what might be the issue here? Any suggestions will be helpful. Thanks.

PortSwigger Agent | Last updated: Aug 02, 2017 07:49AM UTC