Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to implement an exploit server that is being given as a part of burp labs?

Krishna | Last updated: Nov 16, 2021 06:22PM UTC

Hi team, I came across this exploit server for the lab - "ross-site-scripting/contexts/lab-html-context-with-all-standard-tags-blocked" which is actually trying to alert cookie on load of the url mentioned in the solution of the lab which is as below: <script> location = 'https://your-lab-id.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x'; </script> When tried "Deliver exploit to victim" or "view exploit" from the exploit server page, it alerts user. But when I use the same url directly in the browser, it is not alerting me anything. How is this working in reality? Can some insights be provided into this? Are we trying to simulate something using this exploit server? If so, what could be the real time scenario for this?

Hannah, PortSwigger Agent | Last updated: Nov 17, 2021 04:51PM UTC