Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

correct secret not accepted by lab

Sebastian | Last updated: Jun 01, 2024 02:20PM UTC

Hey there, in the lab: Lab: Web shell upload via Content-Type restriction bypass I solved it via uploading a webshell and cat of the secret file. The corresponding secret was not accepted as a solution. I did get carlos secret though, so I think this is a bug. The secret: DCCoYMZpSQf36lq9tN6s61VFGxjMhD8TDCCoYMZpSQf36lq9tN6s61VFGxjMhD8T yours Sebastian

Ben, PortSwigger Agent | Last updated: Jun 03, 2024 07:48AM UTC

Hi Sebastian, What does your exploit look like? Based on the secret being returned, it looks as though you are printing the real secret out twice with whatever exploit you have created (if you notice, the 'DCCoYMZp...' part of the secret is repeated).

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.