I scanned a web app using Burp and it reported this vulnerability. When I click on the issue it show this request and response:


GET / HTTP/1.1

Host: xxxxx.burpcollaborator.net

Pragma: no-cache

Cache-Control: no-cache, no-transform

Connection: close


HTTP/1.1 200  OK Server: Burp Collaborator https://burpcollaborator.net/

X-Collaborator-Version: 4

Content-Type: text/html

Content-Length: 60


When I send the request to repeater and send it, app server gives an error. Advisory says that Burp submitted the payload in the SSL SNI value and the HTTP Host header. I tried to do this manually using curl. I used examples from: https://www.claudiokuenzler.com/blog/693/curious-case-of-curl-ssl-tls-sni-http-host-header

curl --resolve xxxxx.burpcollaborator.net:80:myapp.com http://xxxxx.burpcollaborator.net

openssl s_client -connect myapp.com:443 -servername xxxxx.burpcollaborator.net

After running both of these command I checked burp collaborator client for IP addresses. It only shows my client IP. Server IP address is not included in any interaction.

So if the client is interacting with the alien server (burp in this case) what is the vulnerability in here? Should not it be the server's IP for this to become a vulnerability?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.