Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Intercept Local host sites for testing Collaborator Client

Murali | Last updated: May 19, 2021 02:44PM UTC

Hello all, I am trying to use my intranet site to test External service interaction (HTTP) using collaborator client. This is what the scenario looks like : 1) Application is hosted in an intranet server. 2) Burp Professional is installed on my machine. 3) I open Burp, start with a temporary project, intercepts the request coming through IE. 4) Sends the request to the repeater, and tests the request by clicking the 'Send' button - I get a valid response. 5) Opens Burp Collaborator tool, Generates a payload (1), replaces the payload with what's there in the hostname, and clicks Send. 6) Opens Collaborator Client, and Clicks poll now. Nothing happens - I can't see any entries coming in / recorded. I tried a similar exercise with an external site "https://www.proxysite.com/" and was able to see DNS and HTTP entries. Are there any limitations while working with local intranet sites? Or am I missing some steps here. Very badly need help. Thank you.

Hannah, PortSwigger Agent | Last updated: May 19, 2021 04:03PM UTC

Hi Could you run a Collaborator health check and tell us the output, please? You can find this option by going to "Project options > Misc > Burp Collaborator server > Run health check".

Murali | Last updated: May 19, 2021 05:26PM UTC

Hello, Apart from SMTP Connection on Port 25 all other shows success. For SMTP connection error, I am seeing the detail as " The SMTP response of the capture server was not as expected, perhaps this is not a collaborator server" Thx.

Hannah, PortSwigger Agent | Last updated: May 20, 2021 08:31PM UTC

Hi Have you tried inserting the payload in a different way? You could also check out our labs on Server Side Request Forgery here: https://portswigger.net/web-security/ssrf

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.