Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Basic password reset poisoning seems to be broken

Steven | Last updated: Apr 12, 2023 04:36PM UTC

From the lab solution step 6: "Back in Burp Repeater, change the Host header to your exploit server's domain name (YOUR-EXPLOIT-SERVER-ID.exploit-server.net) and change the username parameter to carlos. Send the request." When I change the host header to my exploit server id I get the error: HTTP/2 421 Misdirected Request Content-Length: 12 Invalid host I did try changing it from HTTP/2 to HTTP/1 and HTTP/1.1 and still got the same error.

Ben, PortSwigger Agent | Last updated: Apr 13, 2023 08:12AM UTC

Hi Steven, Can you clarify how you are changing the protocol? This should work if you navigate to the Inspector pane, expand the Request attributes section and then select the HTTP/1 option under Protocol (if you carry this out within the Repeater request that you will be using).

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.