Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Suite Scanner - SSRF detection

Matt | Last updated: Aug 02, 2019 04:43PM UTC

Hi, With the recent Capital One breach, the SSRF vulnerability has been highlighted as a potential cause/method of the breach. My question is, does either the Burp Suite Pro or Enterprise version automatically detect SSRF while scanning? From what i can find in my research, it appears that you can only detect this with Burp Suite manually

Liam, PortSwigger Agent | Last updated: Aug 05, 2019 07:51AM UTC

Yes, Burp scans for SSRF, the scan check is called Out-of-band resource load (HTTP). - https://portswigger.net/kb/issues/00100a00_out-of-band-resource-load-http Please let us know if you need any further assistance.

Jas | Last updated: Sep 06, 2021 04:38AM UTC

Just tried the Out-of-band resource load (HTTP) scanner to scan the "Lab: Blind SSRF with out-of-band detection" on Web-Security-Academy multiple times, but got nothing reported. Any hints? Thanks.

Hannah, PortSwigger Agent | Last updated: Sep 07, 2021 09:44AM UTC

Apologies, have you tried the "External service interaction (HTTP)" scan check?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.