Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: HTTP/2 request smuggling via CRLF injection - truncated victim session

Sergey | Last updated: May 30, 2023 03:36PM UTC

Hi, It seems impossible to fetch the victim's session because it always gets truncated (see at the end): <li> <a href="/?search=xGET+%2f+HTTP%2f1.1%0d%0aHost%3a+0a9d007303f8166f81224d49006e002f.web-security-academy.net%0d%0acache-control%3a+max-age%3d0%0d%0asec-ch-ua%3a+%22Google+Chrome%22%3bv%3d%22113%22%2c+%22Chromium%22%3bv%3d%22113%22%2c+%22Not-A.Brand%22%3bv%3d%2224%22%0d%0asec-ch-ua-mobile%3a+%3f0%0d%0asec-ch-ua-platform%3a+%22Linux%22%0d%0aupgrade-insecure-requests%3a+1%0d%0auser-agent%3a+Mozilla%2f5.0+%28Victim%29+AppleWebKit%2f537.36+%28KHTML%2c+like+Gecko%29+Chrome%2f113.0.0.0+Safari%2f537.36%0d%0aaccept%3a+text%2fhtml%2capplication%2fxhtml%2bxml%2capplication%2fxml%3bq%3d0.9%2cimage%2favif%2cimage%2fwebp%2cimage%2fapng%2c*%2f*%3bq%3d0.8%2capplication%2fsigned-exchange%3bv%3db3%3bq%3d0.7%0d%0asec-fetch-site%3a+none%0d%0asec-fetch-mode%3a+navigate%0d%0asec-fetch-user%3a+%3f1%0d%0asec-fetch-dest%3a+document%0d%0aaccept-encoding%3a+gzip%2c+deflate%2c+br%0d%0aaccept-language%3a+en-US%2cen%3bq%3d0.9%0d%0acookie%3a+victim-fingerprint%3dNrWsm9BWr4G9rYzBijaPBf6WsTzOdxsa%3b+secret%3dnJIK0Oi3NBNzNUrWZmxhhPcuwQyj3AIW%3b+session%3doZ5d"> xGET / HTTP/1.1 Host: 0a9d007303f8166f81224d49006e002f.web-security-academy.net cache-control: max-age=0 sec-ch-ua: &quot;Google Chrome&quot;;v=&quot;113&quot;, &quot;Chromium&quot;;v=&quot;113&quot;, &quot;Not-A.Brand&quot;;v=&quot;24&quot; sec-ch-ua-mobile: ?0 sec-ch-ua-platform: &quot;Linux&quot; upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: none sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document accept-encoding: gzip, deflate, br accept-language: en-US,en;q=0.9 cookie: victim-fingerprint=NrWsm9BWr4G9rYzBijaPBf6WsTzOdxsa; secret=nJIK0Oi3NBNzNUrWZmxhhPcuwQyj3AIW; session=oZ5d </a> </li>

Ben, PortSwigger Agent | Last updated: May 31, 2023 10:06AM UTC

Hi Sergey, Have you tried increasing the value of the Content-Length header that you are using?

Sergey | Last updated: May 31, 2023 10:45AM UTC