Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Issue with Web Security Academy

Florian | Last updated: Oct 04, 2021 10:01AM UTC

Hi there, I hope you are doing well. I am trying to complete a lab called "Lab: Web cache poisoning with an unkeyed header" and I am doing fully what I am being requested. My steps are: GET / HTTP/1.1 X-Forwarded-Host: exploit-ac981f071fb641fc80453292018a0014.web-security-academy.net Inside exploit server I have the payload -> alert(document.cookie) which is saved. I read that if it doesn't work that the client doesn't view the exploited server, try again till it works. Well I send the exploitable request to Intruder with (Null Payloads) and I keep repeating the same request, and for me it works, but for the victim, its not working somehow. Could you please check if the lab is broken.

James, PortSwigger Agent | Last updated: Oct 04, 2021 04:05PM UTC

Hi Florian,

Thanks for getting in touch.

I just checked the lab and was able to solve it successfully.

At the start, when you are forwarding the request to the repeater, check that this request contains a cookie session. Sometimes the first request captured under HTTP history is missing the cookie, you may have to reload the lab page a couple of times.

Please send the full modified request you are submitting from the repeater if possible and we will have a look for you.

I would also recommend starting over in Burp with a fresh project with default settings, just in case anything previously set is interfering with the lab.

This video is helpful if you did not see it already: https://www.youtube.com/watch?v=ZsrCoheszzo

Florian | Last updated: Oct 05, 2021 01:16PM UTC

Hey James, Thank you very much for your response. It seems right now that it worked. I was doing same as you instructed. As I know I had the cookie inserted within the response. But now it seems that it's working. Anyway thanks again :)

James, PortSwigger Agent | Last updated: Oct 05, 2021 01:25PM UTC