The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Collaborator "payload" field not correct when using multiple tokens

Mike | Last updated: Nov 06, 2023 04:18PM UTC

Perhaps there is a scenario I'm missing where this is a useful feature, but I suspect it is a bug. You have two tokens: abc.oastify.com xyz.oastify.com You make a request `curl -X https://abc.oastify.com -d foo=xyz.oastify.com` This ends up logging a payload hit for xyz.oastify.com (and abc) in the UI, even though there is no request to xyz HTTP/DNS or otherwise. You can see in the host header the request is to abc. Cheers, -Mike

Dominyque, PortSwigger Agent | Last updated: Nov 07, 2023 10:20AM UTC

Hi Mike Thank you for reporting this. We will investigate on our side and update this thread on our findings after doing so.

Dominyque, PortSwigger Agent | Last updated: Nov 09, 2023 10:29AM UTC