Using Burp Collaborator to determine SSRF

SSRF is a vulnerability that allows an attacker to force applications to make unauthorized requests on the attacker's behalf. These requests can be as simple as DNS queries or as maniacal as commands from an attacker-controlled server.

In this recipe, we will use Burp Collaborator to check open ports available for SSRF requests, and then use Intruder to determine whether the application will perform DNS queries to the public Burp Collaborator server through an SSRF vulnerability.

Getting ready

Using the OWASP Mutillidae II DNS lookup page, let's determine whether the application has an SSRF vulnerability.

...