Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Client-side desync

Antonio | Last updated: Oct 27, 2022 07:31AM UTC

Hi, I'm a beginner, i found in one of my reports the client-side desync vulnerability, in "request 1" try to send a second request in the body, in "response 1" i find "405 method not allowed" referred to "post". Since "request 1" is made with post method, is it correct to say that this vulnerability is a false positive? Is there any way to check it? Sorry for the inconvenience and thanks for your help.

Liam, PortSwigger Agent | Last updated: Oct 27, 2022 08:49PM UTC

Hi Antonio. Thanks for your message. Would it be possible to email the full issue detail to support@portswigger.net?

H31s3nb3rg | Last updated: Jun 21, 2023 05:34PM UTC

Hi! In the solution (and here: https://portswigger.net/web-security/request-smuggling/browser/client-side-desync) it is explained that "mode: cors" must be set to handle redirects that could hinder the attack (the connection of the first request would be closed and the second request would be sent on another connection). However, the exact opposite happened to me. Using "mode: no-cors" the attack worked (same connection for the whole attack), while with "cors" things didn't work. Thanks.

Dominyque, PortSwigger Agent | Last updated: Jun 22, 2023 07:35AM UTC