Burp Collaborator Everywhere SSRF Tips That Still Work
Out-of-band beats guessing. If the server fetches something you cannot see in the HTTP response, Collaborator (or your own OOB domain) is how you know the fetch happened.
"Everywhere" is the habit: every URL parameter, every webhook field, every PDF renderer, every avatar importer.
Plant canaries early
Generate a unique subdomain per sink. Do not reuse one Collaborator payload across fifty parameters—you will not know which sink fired. Name payloads after the parameter: url-avatar.<collab>, pdf-template.<collab>.
Watch DNS first. Many SSRF filters block HTTP to IP literals but still resolve DNS. A DNS hit alone can justify deeper testing; an HTTP hit with a path you chose is stronger.
If the product is async, wait. Screenshot processors and link unfurlers often queue. I leave a note with the timestamp and keep hunting elsewhere for fifteen minutes before closing the sink.
Also inject into less obvious carriers: SVG xlink:href, XML external entities only when XXE is in play, markdown image syntax, OpenAPI "try it" callback URLs, and CI webhook test buttons. Same Collaborator discipline applies.
Rotate your OOB zone if the program starts blocking your Collaborator domain. A personal interaction server with unique prefixes per program avoids cross-talk when you juggle multiple targets in one week.
Escalate past a naked ping
Once you have a callback:
- Try HTTP on non-routable hosts only if policy allows (
127.0.0.1, metadata IPs) - Prefer file canaries on internal staging hosts the program provided
- Use redirect chains carefully—some filters check the first hop only
- Compare IPv4 vs IPv6 literals; filters are often uneven
Header injection into the fetched request (host header, extra headers via CRLF in rare stacks) is a separate claim. Get the basic SSRF solid before you dress it up. A DNS canary plus a retrieved secret from an in-scope metadata path is the classic high-impact path—only when the program authorizes that test.
False positives to skip
Browser-side fetches from your own machine are not SSRF. Email clients opening links are not SSRF. Marketing pixels that load in your browser when you view a page you control are noise. Collaborator hits must correlate with server timing and headers (User-Agent of a known crawler, cloud egress ranges).
If the hit arrives only while your browser still has the page open and the User-Agent is Chrome-on-Windows matching you, drop it.
Writeups that survive triage
Show the exact parameter, the Collaborator event (DNS/HTTP), and one follow-up that demonstrates impact appropriate to the program—often reading a canary URL on an internal host, or proving access to a cloud metadata endpoint when that is authorized to test.
Keep a private index of which sinks already pinged so you do not re-burn the same parameter after a partial fix. Partial fixes that only block bare IPs but still allow DNS to your OOB host are common—retest with hostname canaries after every patch note.
SSRF hunting is bookkeeping plus patience. Unique canaries, async waits, then impact. The ping is the start of the report, not the end.