Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Exploiting NoSQL operator injection to extract unknown fields - Does not return user token

Daniel | Last updated: Aug 12, 2024 08:27AM UTC

Hi, I am currently doing the lab Exploiting NoSQL operator injection to extract unknown fields and I am getting all the fields: id,username,password,email but one of them was supposed to be a user's reset token field, that is being used as a parameter in the url to reset the user's password however it does not exist. When I try to look Object.keys(this)[3].match beyond the number 3, I am getting only 500 errors as if im out of index. Can someone guide me if I am doing something wrong or the machine is not well?

Ben, PortSwigger Agent | Last updated: Aug 12, 2024 04:42PM UTC