Support Collaborator Interactions

[ngkogkos]

It would be really nice if there would be an option to create payloads that generate collaborator subdomains and track these interactions, and then report back to the Sitemap's issues.

[justinmoore]

Hey @ngkogkos,

I've honestly never used Burp's collaborator functionality so I'm unsure of how AutoRepeater would fit into it. Could you please explain in more detail how some functionality within AutoRepeater could integrate with Burp's collaborator?

Thanks,
Justin

[ngkogkos]

Hi Justin,

Thanks for the quick reply.

We use collaborator a lot internally to identify any out-of-band or other weird vulnerabilities. Sometimes it helped me exploit complex SQLis or other injections as well.

It could work in similar fashion to the Burp Collaborator client. It could basically generate unique subdomains which the collaborator server can track, and if any interaction happens with them, AutoRepeater/Burp would know this and display an issue under the site's target issues, if that makes sense.

Active Scanner does something similar, it injects command injection payloads, SQLi payloads etc, that contain DNS resolution commands, or HTTP/SMTP requests to the collaborator domain. This can be tracked by the burp client and it knows which payload worked. Using the Flow plugin, filter by Active Scanner and you can see such payloads.

Note that people can either use the free PortSwigger's collaborator, or setup a private one.

So AutoRepeater could have a check option, which upon enabled for a replacements "tab" or payload, would replace a placeholder such as COLLAB, with unique collaborator subdomains and track any interactions down.

PS: Something to consider, adding collaborator functionality may require the plugin to become Pro plugin only, although I am not certain of this.