Bug Reports - Burp Suite User Forum

Lab: HTTP request smuggling, basic TE.CL vulnerability

I am running through the labs again in prep to take the test. I think this lab has stopped working. Regardless of what I do, it does not seem like the backend is honoring the Content-Length header. I've tried multiple...

Burp possibly doesn't close HTTP2 gRPC connection gracefully

First of all, thank you for your great efforts to make HTTP2 available in Burp. I'm using Go gRPC example application named RouteGuide(https://github.com/grpc/grpc-go/tree/master/examples/route_guide) to check Burp can...

Install Script Leaks the java binary

The Download and Install Bash script for arm Linux when you install Professional Burp suite is leaks the java bin. -- output: └─$ bash burpsuite_pro_linux_arm64_v2024_7_6.sh > Unpacking JRE ... > Starting Installer...

solved lab is showing not solved

i've succesfully sovled the lab Method-based access control can be circumvented but it shows that i dint solve it when i am redirected to the homepage

Basic clickjacking with CSRF token protection can't be solved

https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected I have tried with firefox and chrome.I am doing exactly what the solution says and I have also watched the community solutions.But none of them work...

Cannot set up Chromium DevTools overrides in embedded browser

When I open DevTools -> Sources -> Overrides and select a new folder for overrides, I get the prompt "DevTOols requests full access to [path...]". I click Allow, and then nothing happens. I do not have this issue with...

When I use the "show response in browser" the url does not work

Hi When I use this feature I receive a message : Unknown host : burpsuite the url is like "burpsuite:/repeat/3/epmnkg....." Would you please help me about this ? Thks

Lab: Exploiting a mass assignment vulnerability doesn't allow POST reqs

Hello, When trying to solve this lab following the given solution, after sending a POST /api/checkout request, I got a 400 Bad Request Error: {"error": "Malformed URL: query only supported with GET"}. Is this...

Vertically split UI extension not fully resizable

Hi there! We are running into a new issue since 2024.7.6 where as an example, the Authorize extension right panel isn't fully resizable. It appear that the UI will not resize smaller than the right most component on the...

Freeze on Screen Lock (macOS)

Burp Suite Pro seems to lock up every time my screen lock activates. This is Ventura 13.4 running on M2 silicon with v2024.3.1.3 When resuming, the only button that works is close and then the confirm dialog shows which...

"Blacklisted" responses in the WebSocket handshake manipulation lab

Hi, for some reason I started receiving an Unauthorized response during the lab "Manipulating the WebSocket handshake to exploit vulnerabilities" This only occurs at the /chat endpoint Request url (GET from...

Faulty Lab: "CORS vulnerability with trusted insecure protocols"

Hi, maybe there is bug inside the laboratory "CORS vulnerability with trusted insecure protocols". The following exploit script works with Burp's Chrome: <script> document.location =...

CSRF Labs are buggy not working

Currently i'm trying to solve the CSRF labs. However, it seems that these are not working properly; It seems that the system doensn't work when you "deliver exloit to user". I know for a fact that the CSRF Payload is...

Academy - Lab: Username enumeration via response timing - Unable to access usernames/passwords

Hello, In the Lab: Username enumeration via response timing, the list of candidate usernames/passwords is not accessible. In the lab, the below are not linked to anything, they seem to just be plain text. Candidate...

Lab: CSRF vulnerability with no defenses

Hello, going through the lab https://portswigger.net/web-security/csrf/lab-no-defenses, for some reason he does not solved. https://forum.portswigger.net/thread/lab-csrf-vulnerability-with-no-defenses-35a98ebd I had...

the Dashoard tab wasn't visible

the Dashoard tab wasn't visible for projects with crawl tasks started。

Burp Collaborator Problem

I have installed burpsuite and the cerification tested it and all works fine, I can intercept the HTTP&HTTPS requests, but the collaborator doesn't works. I have tried to made a normal get request from the browser to the...

Solution not functional: "Lab: HTTP request smuggling, confirming a TE.CL vulnerability via differential responses"

The solution provided in the following lab is not functioning correctly: "Lab: HTTP request smuggling, confirming a TE.CL vulnerability via differential responses" After setting the correct host header and ensuring that...

'Stream failed to close correctly' when trying to load one lab

Accidentally broke one of the labs - https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-cookie-refresh steps to reproduce: - open burpsuite chromium browser - copy...

memory leak issues with Burp Suite Pro?

My company uses Burp Suite Pro to scan a number of websites, some of these we scan roughly quarterly. Our systems team manages the updates to Burp Suite Pro on a monthly basis, so we're not necessarily always using the very...