Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

SQLi Intruder Payloads - Determine which payload has external interaction

Trevor | Last updated: Mar 03, 2023 02:15PM UTC

Given a page that is vulnerable to OOB SQLi. Let's say that I run this through intruder using the SQLi payloads. How can I tell which payload triggers the external interaction? In order to setup Intruder I choose a simple list and load the SQLi payloads. I then match/replace `{domain}` with the collaborator domain. Unfortunately collaborator will only show that a request was made, but not which payload triggered the interaction. How can I (quickly) fix the intruder payload so that there is some indicator of which payload triggered the request? The only thing that comes to mind would be to export the payload list, modify each spot that has `{domain}` to be `{an interator}.{domain}`, but is that the best way?

Hannah, PortSwigger Agent | Last updated: Mar 06, 2023 10:49AM UTC

Hi We will be adding support for this functionality coming soon - you can check this item out on our roadmap here: https://portswigger.net/blog/burp-suite-roadmap-update-january-2023#:~:text=Collaborator%20payloads%20in%20Intruder%20attacks

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.