Skip to main content

​
Overview

HTTP Request Logger provides callback endpoints that capture incoming HTTP requests, so you can validate out-of-band (OOB) vulnerabilities like SSRF, XXE, blind SQL injection, and command injection. This feature is sometimes referred to as HTTP Handlers in older documentation. HTTP Request Logger is an exploit helper tool: it receives callbacks triggered by vulnerable applications to prove exploitation. It does not add data to your Attack Surface and does not generate findings. Captured requests are displayed in a custom report.

​
How it works

1

Create a handler

Generate a unique handler with a custom label.
2

Get the handler URL

Copy the unique callback URL.
3

Craft payloads

Include the handler URL in your test payloads.
4

Trigger the vulnerability

Submit payloads to the target application.
5

Review callbacks

View captured HTTP requests in the handler’s report.

​
Creating a handler

When creating a handler, provide: After creation, you receive a handler URL in the format:
Use descriptive labels like ssrf-test-1 or xxe-payment-endpoint to easily identify which test triggered each callback.

​
Captured data

For each HTTP request received, the handler captures:

​
Handler limits

Handlers automatically expire after 60 days. Create a new handler if you need to continue testing.

​
Use cases

​
SSRF testing

Test if a server makes outbound requests to attacker-controlled URLs:
Include this URL in parameters that accept URLs (webhooks, image URLs, API endpoints).

​
XXE testing

Detect XML External Entity injection with external DTD references:

​
Blind SQL Injection

Confirm SQL injection when no output is visible using database-specific HTTP functions:

​
Command injection

Verify command execution on the target server:

​
DNS rebinding / TOCTOU

Test time-of-check to time-of-use vulnerabilities by monitoring multiple requests.
HTTP Request Logger may receive requests containing sensitive data from vulnerable applications. Handle captured data responsibly and delete after testing.

​
Follow-up actions

After capturing callbacks:
  • Document the finding: Include callback evidence in your security report
  • Identify internal infrastructure: Analyze source IPs and headers for internal network details
  • Test data exfiltration: Attempt to extract sensitive data via the callback channel
  • Check for chaining: Combine with other vulnerabilities (e.g., SSRF to internal services)
  • Run Website Scanner: Find additional injection points
  • Use Sniper: Test for known SSRF and XXE vulnerabilities