Burp Suite User Forum

Login to post

Lab: Bypassing access controls via HTTP/2 request tunnelling - Not getting the desired response.

Gourav | Last updated: Jan 09, 2022 05:17PM UTC

Hi All, I am following the solution mentioned in the lab solution. In the last step when I change the :path to /admin, I get the following response, "HTTP/2 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 150 <html><head><title>Server Error: Proxy error</title></head><body><h1>Server Error: Received only 174 of expected 2428 bytes of data</h1></body></html>" And when I use something else in path such as /home or /administrator, I get the following response, "HTTP/2 404 Not Found Content-Type: application/json; charset=utf-8 Set-Cookie: session=b3H8XzevAZ5RHQVbxmVZE1gwpaEP5j9v; Secure; HttpOnly; SameSite=None Content-Length: 11 HTTP/1.1 40" I have tried the videos available on Youtube but I am unable to solve this lab. Please help.

Hannah, PortSwigger Agent | Last updated: Jan 12, 2022 01:29PM UTC

Hi Is it the final step that you are having issues with? Did you see the start of the tunnelled HTTP/1.1 response nested in the body of your main response when you used the "/login" path?

Diego | Last updated: Sep 20, 2022 02:02PM UTC

Blocked on the last step, I see HTTP/1.1 nidified but I still receive error server: received Only 174 of Expected 3247 Bytes of Data. Can you help me?

Hannah, PortSwigger Agent | Last updated: Sep 21, 2022 09:08AM UTC

Hi If you're on the last step, then it's expected to receive an error. Carlos should still be deleted, and the lab should be marked as solved. Please make sure that you are using HTTP/2.

You need to Log in to post a reply. Or register here, for free.