搭建自己的Burp Collaborator服务器详细指南

1. Burp Collaborator简介

Burp Collaborator是一种外部服务，在使用Burp Suite进行渗透测试时，可以借助该服务来发掘各种安全漏洞。主要用途包括：

• 检测带外XSS漏洞：当应用程序从外部URL获取内容并在响应中返回时
• 检测基于注入的漏洞：如SQL盲注等不会导致响应内容或时间变化的漏洞
• 检测邮件标题注入等特定服务相关的漏洞

2. 准备工作

在开始搭建前，需要准备以下资源：

1. VPS服务器：推荐使用Debian系统
2. 域名：用于配置DNS记录和SSL证书
3. Let's Encrypt：用于获取免费的通配符SSL证书
4. Burp Suite Pro：需要专业版jar文件

3. 搭建环境

3.1 安装必要软件

# 更新包索引
sudo apt-get update

# 安装Java运行时环境(JRE)
sudo apt-get install default-jre

# 安装iptables-persistent
sudo apt-get install iptables-persistent

3.2 创建工作目录

sudo mkdir -p /usr/local/collaborator/

将burpsuite_pro_<latest_version>.jar上传到/usr/local/collaborator/目录

3.3 创建专用系统用户

sudo adduser --shell /bin/nologin --no-create-home --system collaborator
sudo chown collaborator /usr/local/collaborator

4. 配置Collaborator服务器

4.1 创建配置文件

创建/usr/local/collaborator/collaborator.config文件，内容如下（需根据实际情况修改）：

{
  "serverDomain": "my-subdomain-for-burp.example.com",
  "workerThreads": 10,
  "eventCapture": {
    "localAddress": ["54.38.**.**"],
    "publicAddress": "54.38.**.**",
    "http": {"ports": 3380},
    "https": {"ports": 33443},
    "smtp": {"ports": [3325, 33587]},
    "smtps": {"ports": 33465},
    "ssl": {
      "certificateFiles": [
        "/usr/local/collaborator/keys/privkey.pem",
        "/usr/local/collaborator/keys/cert.pem",
        "/usr/local/collaborator/keys/fullchain.pem"
      ]
    }
  },
  "polling": {
    "localAddress": "54.38.**.**",
    "publicAddress": "54.38.**.**",
    "http": {"port": 39090},
    "https": {"port": 39443},
    "ssl": {
      "certificateFiles": [
        "/usr/local/collaborator/keys/privkey.pem",
        "/usr/local/collaborator/keys/cert.pem",
        "/usr/local/collaborator/keys/fullchain.pem"
      ]
    }
  },
  "metrics": {
    "path": "jnaicmez8",
    "addressWhitelist": ["0.0.0.0/1"]
  },
  "dns": {
    "interfaces": [{
      "name": "ns1.my-subdomain-for-burp.example.com",
      "localAddress": "54.38.**.**",
      "publicAddress": "54.38.**.**"
    }],
    "ports": 3353
  },
  "logLevel": "INFO"
}

注意：所有端口号必须高于1024，以便Collaborator能以非root用户身份运行。

5. 设置通配符SSL证书

5.1 安装Certbot

cd /usr/local/collaborator/
wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto

5.2 创建证书配置脚本

创建/usr/local/collaborator/configure_certs.sh：

#!/bin/bash

CERTBOT_DOMAIN=$1
if [ -z $1 ]; then
  echo "Missing mandatory argument."
  echo " - Usage: $0 <domain>"
  exit 1
fi

CERT_PATH=/etc/letsencrypt/live/$CERTBOT_DOMAIN/
mkdir -p /usr/local/collaborator/keys/

if [[ -f $CERT_PATH/privkey.pem && -f $CERT_PATH/fullchain.pem && -f $CERT_PATH/cert.pem ]]; then
  cp $CERT_PATH/privkey.pem /usr/local/collaborator/keys/
  cp $CERT_PATH/fullchain.pem /usr/local/collaborator/keys/
  cp $CERT_PATH/cert.pem /usr/local/collaborator/keys/
  chown -R collaborator /usr/local/collaborator/keys
  echo "Certificates installed successfully"
else
  echo "Unable to find certificates in $CERT_PATH"
fi

5.3 获取证书

./certbot-auto certonly -d my-subdomain-for-burp.example.com -d *.my-subdomain-for-burp.example.com \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --manual --agree-tos --no-eff-email \
  --manual-public-ip-logging-ok \
  --preferred-challenges dns-01

按照提示操作，需要添加两条DNS TXT记录：

1. _acme-challenge.my-subdomain-for-burp.example.com → YKoOF0jc6wqZJLUIhF3YQJ8MzyWWfkT3weW24_8hhBU
2. _acme-challenge.my-subdomain-for-burp.example.com → s10-sRD0KPJfFujYl5_ql6TEQkwkVppLZLW45ITK-d4

5.4 安装证书

chmod +x /usr/local/collaborator/configure_certs.sh
/usr/local/collaborator/configure_certs.sh my-subdomain-for-burp.example.com

6. 测试Collaborator服务器

sudo -H -u collaborator bash -c "java -Xms10m -Xmx200m -XX:GCTimeRatio=19 -jar /usr/local/collaborator/burpsuite_pro_1.7.33.jar --collaborator-server --collaborator-config=/usr/local/collaborator/collaborator.config"

成功启动后应看到类似输出：

2018-04-08 19:46:36.082: Using configuration file /usr/local/collaborator/collaborator.config
2018-04-08 19:46:37.473: Listening for DNS on 54.38.**.**:3353
2018-04-08 19:46:37.486: Listening for HTTP on 54.38.**.**:39090
...

7. 配置DNS

在DNS服务器上添加以下记录：

1. NS记录：ns1.my-subdomain-for-burp.example.com
2. A记录：指向VPS的IP地址（如54.38..）

8. 配置iptables端口转发

iptables -t nat -A PREROUTING -i ens3 -p udp --dport 53 -j REDIRECT --to-port 3353
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 9090 -j REDIRECT --to-port 39090
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 25 -j REDIRECT --to-port 3325
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 80 -j REDIRECT --to-port 3380
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 587 -j REDIRECT --to-port 33587
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 465 -j REDIRECT --to-port 33465
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 9443 -j REDIRECT --to-port 39443
iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 443 -j REDIRECT --to-port 33443
iptables-save

9. 将Collaborator设置为系统服务

创建/etc/systemd/system/collaborator.service：

[Unit]
Description=Burp Collaborator Server Daemon
After=network.target

[Service]
Type=simple
User=collaborator
UMask=007
ExecStart=/usr/bin/java -Xms10m -Xmx200m -XX:GCTimeRatio=19 -jar /usr/local/collaborator/burpsuite_pro_1.7.33.jar --collaborator-server --collaborator-config=/usr/local/collaborator/collaborator.config
Restart=on-failure
TimeoutStopSec=300

[Install]
WantedBy=multi-user.target

启用并启动服务：

systemctl enable collaborator
systemctl start collaborator

10. 配置Burp Suite

在Burp Suite中进行以下配置：

1. 打开"Project Options" > "Misc"选项卡
2. 设置：
   • Server location: my-subdomain-for-burp.example.com
   • Polling location (optional): my-subdomain-for-burp.example.com:9443

11. 验证

至此，自定义的Burp Collaborator服务器已搭建完成。可以通过Burp Suite发送测试请求来验证服务器是否正常工作。