Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Getting a cache hit for a redirect

noop | Last updated: Mar 30, 2020 11:03AM UTC

I've been playing with this lab for sometime in different browsers but cannot get a cache hit once I add the additional headers to trigger the HTTP 302 Redirect. I'm probably doing something wrong but even after looking at the solution and trying it out I was still unsuccessful even after completing the previous labs in this section. https://portswigger.net/web-security/web-cache-poisoning/exploiting/lab-web-cache-poisoning-with-multiple-headers Request with Modified Headers -------------------------------- GET /resources/js/tracking.js?cb=111 HTTP/1.1 Host: ac641fbc1eeb052b807d27e600260003.web-security-academy.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:74.0) Gecko/20100101 Firefox/74.0 Accept: */* Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: https://ac641fbc1eeb052b807d27e600260003.web-security-academy.net/ Cookie: session=aY1MZldZt9hvAkYbw69fOtgmQg1gdhyg Cache-Control: max-age=0 X-Forwarded-Scheme: nothttps X-Forwarded-Host: example.org Upgrade-Insecure-Requests: 1 Response ---------- HTTP/1.1 302 Found Location: https://example.org/resources/js/tracking.js?cb=111&i63w82=1 Keep-Alive: timeout=0 Cache-Control: max-age=30 Age: 0 X-Cache: miss X-XSS-Protection: 0 Connection: close Content-Length: 0

Hannah, PortSwigger Agent | Last updated: Mar 30, 2020 11:40AM UTC

Hi Do you have the param-miner extension installed? If so, can you check that you do not have "Add dynamic cachebuster" enabled? Alternatively, you could unload the extension and then retry the lab.

noop | Last updated: Mar 30, 2020 01:06PM UTC

That was it. Seems to have been Param Miner extension. Thanks for the tip!

Hannah, PortSwigger Agent | Last updated: Mar 30, 2020 01:15PM UTC

I'm glad your issue was resolved. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.