Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Exploiting HTTP request smuggling to perform web cache poisoning - broken?

James | Last updated: Jul 07, 2023 11:46AM UTC

Hi, the above lab cannot be solved (using the solution, the community solution or 3rd party solutions anyway). The community solution is outdated now, but the comments on the official YT page are also saying they are unable to solve it. The best I've managed is to get the page to redirect to the exploit server and display "alert(document.cookie)" as text but it refuses to display it as a pop up as required. I've repeated literally hundreds of times now but no success. J Ford

Michelle, PortSwigger Agent | Last updated: Jul 10, 2023 08:57AM UTC

Hi We've just tested the lab here, and we were able to solve it. Can you tell us more about the steps you were taking? Did you send the requests using HTTP/1.1? After getting the page to redirect to the exploit server, did you refresh the lab's home page?

James | Last updated: Jul 21, 2023 10:57AM UTC

Hi, Please ignore / delete, turns out it was an issue with the Param Miner extension being on. Now solved as expected. James

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.