The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Academy || lab-password-reset-poisoning-via-middleware

Stephan | Last updated: Jan 20, 2022 03:43PM UTC

Hi, I notices that no Forward header or other related headers showed in the solution works for me. Also the Youtube video is mutch different then what is in the lab. NO CSRF token is in place for example. What I'm doing wrong or is the solution not working anymore? https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-poisoning-via-middleware

Maia, PortSwigger Agent | Last updated: Jan 21, 2022 02:28PM UTC

Hi, I can confirm that the lab is working using the solution provided. The community solution video does look to be out of date, so we will look into that. Are you adding the X-Forwarded-Host header with your exploit server in Burp Repeater and changing the username parameter?

harsh | Last updated: Dec 29, 2022 08:41AM UTC

yes

Ben, PortSwigger Agent | Last updated: Jan 02, 2023 09:28AM UTC