Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp Suite Scanner - SSRF detection

Matt | Last updated: Aug 02, 2019 04:43PM UTC

Hi, With the recent Capital One breach, the SSRF vulnerability has been highlighted as a potential cause/method of the breach. My question is, does either the Burp Suite Pro or Enterprise version automatically detect SSRF while scanning? From what i can find in my research, it appears that you can only detect this with Burp Suite manually

Liam, PortSwigger Agent | Last updated: Aug 05, 2019 07:51AM UTC

Yes, Burp scans for SSRF, the scan check is called Out-of-band resource load (HTTP). - https://portswigger.net/kb/issues/00100a00_out-of-band-resource-load-http Please let us know if you need any further assistance.

Jas | Last updated: Sep 06, 2021 04:38AM UTC

Just tried the Out-of-band resource load (HTTP) scanner to scan the "Lab: Blind SSRF with out-of-band detection" on Web-Security-Academy multiple times, but got nothing reported. Any hints? Thanks.

Hannah, PortSwigger Agent | Last updated: Sep 07, 2021 09:44AM UTC