The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Host validation bypass via connection state attack does not work as intended

Александр | Last updated: Mar 25, 2023 02:36PM UTC

https://portswigger.net/web-security/host-header/exploiting/lab-host-header-host-validation-bypass-via-connection-state-attack The lab does not require to conduct request smuggling attack and can be easily solved by the following request: POST /admin/delete HTTP/2 Host: 192.168.0.1 Content-Length: 53 csrf=NilcKMOGIVTxMjz02MUr8COY1GyWZA58&username=carlos I guess something is wrong with the initial Host check function.

Michelle, PortSwigger Agent | Last updated: Mar 27, 2023 01:20PM UTC

Thanks for getting in touch. Can you confirm the steps you took prior to sending this request? Were the steps prior to this the same as in the solution?

Александр | Last updated: Mar 27, 2023 10:11PM UTC

Well, no. I first directly accessed /admin to get the token and than just used it.

Michelle, PortSwigger Agent | Last updated: Mar 28, 2023 11:57AM UTC