0

I scanned a web app using Burp and it reported this vulnerability. When I click on the issue it show this request and response:

Request:

GET / HTTP/1.1

Host: xxxxx.burpcollaborator.net

Pragma: no-cache

Cache-Control: no-cache, no-transform

Connection: close

Response:

HTTP/1.1 200  OK Server: Burp Collaborator https://burpcollaborator.net/

X-Collaborator-Version: 4

Content-Type: text/html

Content-Length: 60

<html><body>blablalbalbalbalbalbalba</body></html>

When I send the request to repeater and send it, app server gives an error. Advisory says that Burp submitted the payload in the SSL SNI value and the HTTP Host header. I tried to do this manually using curl. I used examples from: https://www.claudiokuenzler.com/blog/693/curious-case-of-curl-ssl-tls-sni-http-host-header

curl --resolve xxxxx.burpcollaborator.net:80:myapp.com http://xxxxx.burpcollaborator.net

openssl s_client -connect myapp.com:443 -servername xxxxx.burpcollaborator.net

After running both of these command I checked burp collaborator client for IP addresses. It only shows my client IP. Server IP address is not included in any interaction.

So if the client is interacting with the alien server (burp in this case) what is the vulnerability in here? Should not it be the server's IP for this to become a vulnerability?

  • Are you able to replicate the same? Even i need help with this. – Sundeep Pidugu Jul 22 at 7:08
  • I opened a ticket to Burp for this, they investigated it and decided that this happens when you are behind a corporate firewall. – mk_ Jul 23 at 8:12
  • Okay, thanks for informing me. – Sundeep Pidugu Jul 23 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.