Performing out-of-data extraction using XXE and Burp Suite collaborator

Burp Suite collaborator is a service used to detect vulnerabilities mostly when an application tries to interact with external services. Burp Suite analyzes the interactions with external systems and detects unusual behaviors. In order to analyze the application, Burp Suite collaborator sends inputs or payloads to the application and waits for a response.

So, in this case, Burp Suite is working a server, where the application interacts using common services, such as DNS, SMTP, or HTTP.

Using Burp Suite to exploit the vulnerability

Open Burp Suite in the main Dashboard tab, and click on the New scan option, as demonstrated in the following screenshot. Remember that these options are only available in Burp Suite Professional, and not in the Community Edition:

When you use the scanner, Burp Suite tests the application for vulnerabilities. Here, you can modify options about how the scanner did its job, and also configure credentials...