Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Getting a cache hit for a redirect

noop | Last updated: Mar 30, 2020 11:03AM UTC

I've been playing with this lab for sometime in different browsers but cannot get a cache hit once I add the additional headers to trigger the HTTP 302 Redirect. I'm probably doing something wrong but even after looking at the solution and trying it out I was still unsuccessful even after completing the previous labs in this section. https://portswigger.net/web-security/web-cache-poisoning/exploiting/lab-web-cache-poisoning-with-multiple-headers Request with Modified Headers -------------------------------- GET /resources/js/tracking.js?cb=111 HTTP/1.1 Host: ac641fbc1eeb052b807d27e600260003.web-security-academy.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:74.0) Gecko/20100101 Firefox/74.0 Accept: */* Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: https://ac641fbc1eeb052b807d27e600260003.web-security-academy.net/ Cookie: session=aY1MZldZt9hvAkYbw69fOtgmQg1gdhyg Cache-Control: max-age=0 X-Forwarded-Scheme: nothttps X-Forwarded-Host: example.org Upgrade-Insecure-Requests: 1 Response ---------- HTTP/1.1 302 Found Location: https://example.org/resources/js/tracking.js?cb=111&i63w82=1 Keep-Alive: timeout=0 Cache-Control: max-age=30 Age: 0 X-Cache: miss X-XSS-Protection: 0 Connection: close Content-Length: 0

Hannah, PortSwigger Agent | Last updated: Mar 30, 2020 11:40AM UTC

Hi Do you have the param-miner extension installed? If so, can you check that you do not have "Add dynamic cachebuster" enabled? Alternatively, you could unload the extension and then retry the lab.

noop | Last updated: Mar 30, 2020 01:06PM UTC

That was it. Seems to have been Param Miner extension. Thanks for the tip!

Hannah, PortSwigger Agent | Last updated: Mar 30, 2020 01:15PM UTC