Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Exploiting cross-site scripting to steal cookies, the simulated user does not visit the page (no autofilled creds)

Ewelina | Last updated: May 24, 2021 01:06PM UTC

Hello! the Exploiting cross-site scripting to capture passwords lab seems to not work. been trying for 3 hours now. No simulated user visits the page hence no autofilled credentials are put into the input fields and sent to collaborator. I have both tried my own payloads and the one that you have in the solution. And both over http and https. I can manually fill in the values and then they're sent over to collaborator, but only then.

Ben, PortSwigger Agent | Last updated: May 24, 2021 05:47PM UTC

Hi Ewelina, Are you able to provide us with the exact details of the steps that you are taking to try and solve this lab so that we can take a look for you? I did carry out a quick run through, using the solution provided, and was able to successfully solve the lab so it does look as though it is functioning as expected.

Ewelina | Last updated: May 24, 2021 07:35PM UTC

Hello! I just tried again and this time it worked! My co-workers had the same issue though and it worked for them too after couple of hours. Strange!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.