Collaborator

Collaborator

Some bugs never show their result on the page. The only sign is that the target reaches out to a server somewhere else. Collaborator gives you unique callback URLs and catches those DNS and HTTP interactions for you.

Use it to find:

• blind SSRF;
• XXE;
• blind injection;
• other out-of-band bugs.

It works in the desktop app, in the web console, and through your XHack link.

Use it

1. Click Collaborator in the toolbar.
2. Click New payload, then Copy URL.
3. Put the URL where you are testing for a blind interaction, for example a parameter, a header or an XML entity.
4. Any DNS or HTTP hits appear in the list automatically. Click Poll now to check straight away.

Look at a hit

1. Select a hit to see the raw request.
2. Click Copy to copy it, or Send to Repeater to work with it there. See HTTP Repeater.

Settings and clean-up

• Settings lets you choose the callback server.
• Clear empties the list.

Let the AI do it

Ask the AI to test for blind SSRF or other out-of-band issues. It uses Collaborator by itself.

Good practice

• Only test targets in scope. Put callback URLs only into systems you are allowed to test.
• Use one payload per test spot. Then you know exactly which hit came from where.

Related

• HTTP Repeater
• Role profiles and access matrix
• Findings & Reports
• Bug-Bounty Hunting