agent hit Burp collaborator rate limit mid-authorized-test and failed to recover dropped callbacks

TL;DR

Dropped collaborator callbacks are inconclusive, never negative. The agent should slow payload delivery to stay under the collaborator rate limit, queue every payload that needs a callback, and re-poll for late callbacks before closing out. Silence after throttling proves nothing about the target.

agent hit Burp collaborator rate limit mid-authorized-test and failed to recover dropped callbacks

Use this when

• Burp Collaborator starts rate-limiting or dropping callbacks mid-test and the agent marks out-of-band tests as passed/failed.
• The agent fires all collaborator payloads in one burst, then moves on.
• Late callbacks arrive after the agent already closed the finding as negative.

Not for this skill when

• The collaborator server is unreachable from the start (DNS, firewall). That is a connectivity problem.
• The test does not use out-of-band techniques at all. Then collaborator limits are irrelevant.
• The engagement forbids out-of-band testing. Respect the scope.

Steps

1. Pace collaborator payload delivery: send in small batches with pauses between them instead of one burst. Verify: a test batch completes without rate-limit warnings in the collaborator client.
2. Record every payload-to-interaction mapping (which payload expects a callback, sent at what time) in a queue file before sending. Verify: the queue lists each payload with its expected callback identifier.
3. Poll the collaborator for interactions on a schedule after the last payload, including a final poll at least 15 minutes after sending. Verify: the poll log shows the final check timestamp.
4. Mark any payload with no callback as inconclusive in the notes, with the throttling window documented, not as negative. Verify: the report distinguishes "no callback observed" from "tested, not vulnerable".
5. Retry inconclusive payloads in a later, slower batch rather than dropping them. Verify: the retry batch references the queue file's unanswered entries.

Variant phrasings

collaborator callbacks dropped under rate limit

Same queue-and-repoll fix.

agent marked OOB test negative after throttling

Reporting-focused variant.

Burp collaborator throttled during agent test

Tool-symptom phrasing.

Compatibility: Burp Suite Professional with Collaborator. The queue-and-repoll pattern works with the built-in or a private collaborator server.

Why it happens

Agents treat request-response testing as the whole world: send payload, read response, decide. Out-of-band testing breaks that loop because the answer arrives later through a different channel, and rate limiting makes the channel lossy. An agent with no callback queue has no way to distinguish "target did not call back" from "callback was dropped", so it guesses, and the guess is usually wrong.

Edge cases / pitfalls

• Callbacks can arrive hours late on slow targets. Define the poll window in the test plan up front so "inconclusive" has a clear cutoff.
• Never treat a missing callback as proof of safety in the final report. Out-of-band negatives require a clean, unthrottled run to be meaningful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Ijr1dbd3gtaNn9bIJLh7DQ