Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

SQLi Intruder Payloads - Determine which payload has external interaction

Trevor | Last updated: Mar 03, 2023 02:15PM UTC

Given a page that is vulnerable to OOB SQLi. Let's say that I run this through intruder using the SQLi payloads. How can I tell which payload triggers the external interaction? In order to setup Intruder I choose a simple list and load the SQLi payloads. I then match/replace `{domain}` with the collaborator domain. Unfortunately collaborator will only show that a request was made, but not which payload triggered the interaction. How can I (quickly) fix the intruder payload so that there is some indicator of which payload triggered the request? The only thing that comes to mind would be to export the payload list, modify each spot that has `{domain}` to be `{an interator}.{domain}`, but is that the best way?

Hannah, PortSwigger Agent | Last updated: Mar 06, 2023 10:49AM UTC