Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

How to implement an exploit server that is being given as a part of burp labs?

Krishna | Last updated: Nov 16, 2021 06:22PM UTC

Hi team, I came across this exploit server for the lab - "ross-site-scripting/contexts/lab-html-context-with-all-standard-tags-blocked" which is actually trying to alert cookie on load of the url mentioned in the solution of the lab which is as below: <script> location = 'https://your-lab-id.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x'; </script> When tried "Deliver exploit to victim" or "view exploit" from the exploit server page, it alerts user. But when I use the same url directly in the browser, it is not alerting me anything. How is this working in reality? Can some insights be provided into this? Are we trying to simulate something using this exploit server? If so, what could be the real time scenario for this?

Hannah, PortSwigger Agent | Last updated: Nov 17, 2021 04:51PM UTC

Hi When I go to the URL "https://your-lab-id.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x" in my browser (replacing with my lab ID as appropriate) then I do receive the onfocus alert popup whenever the tab is in focus. If you retry using the URL, do you get the same results?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.