Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: HTTP/2 request smuggling via CRLF injection - truncated victim session

Sergey | Last updated: May 30, 2023 03:36PM UTC

Hi, It seems impossible to fetch the victim's session because it always gets truncated (see at the end): <li> <a href="/?search=xGET+%2f+HTTP%2f1.1%0d%0aHost%3a+0a9d007303f8166f81224d49006e002f.web-security-academy.net%0d%0acache-control%3a+max-age%3d0%0d%0asec-ch-ua%3a+%22Google+Chrome%22%3bv%3d%22113%22%2c+%22Chromium%22%3bv%3d%22113%22%2c+%22Not-A.Brand%22%3bv%3d%2224%22%0d%0asec-ch-ua-mobile%3a+%3f0%0d%0asec-ch-ua-platform%3a+%22Linux%22%0d%0aupgrade-insecure-requests%3a+1%0d%0auser-agent%3a+Mozilla%2f5.0+%28Victim%29+AppleWebKit%2f537.36+%28KHTML%2c+like+Gecko%29+Chrome%2f113.0.0.0+Safari%2f537.36%0d%0aaccept%3a+text%2fhtml%2capplication%2fxhtml%2bxml%2capplication%2fxml%3bq%3d0.9%2cimage%2favif%2cimage%2fwebp%2cimage%2fapng%2c*%2f*%3bq%3d0.8%2capplication%2fsigned-exchange%3bv%3db3%3bq%3d0.7%0d%0asec-fetch-site%3a+none%0d%0asec-fetch-mode%3a+navigate%0d%0asec-fetch-user%3a+%3f1%0d%0asec-fetch-dest%3a+document%0d%0aaccept-encoding%3a+gzip%2c+deflate%2c+br%0d%0aaccept-language%3a+en-US%2cen%3bq%3d0.9%0d%0acookie%3a+victim-fingerprint%3dNrWsm9BWr4G9rYzBijaPBf6WsTzOdxsa%3b+secret%3dnJIK0Oi3NBNzNUrWZmxhhPcuwQyj3AIW%3b+session%3doZ5d"> xGET / HTTP/1.1 Host: 0a9d007303f8166f81224d49006e002f.web-security-academy.net cache-control: max-age=0 sec-ch-ua: &quot;Google Chrome&quot;;v=&quot;113&quot;, &quot;Chromium&quot;;v=&quot;113&quot;, &quot;Not-A.Brand&quot;;v=&quot;24&quot; sec-ch-ua-mobile: ?0 sec-ch-ua-platform: &quot;Linux&quot; upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: none sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document accept-encoding: gzip, deflate, br accept-language: en-US,en;q=0.9 cookie: victim-fingerprint=NrWsm9BWr4G9rYzBijaPBf6WsTzOdxsa; secret=nJIK0Oi3NBNzNUrWZmxhhPcuwQyj3AIW; session=oZ5d </a> </li>

Ben, PortSwigger Agent | Last updated: May 31, 2023 10:06AM UTC

Hi Sergey, Have you tried increasing the value of the Content-Length header that you are using?

Sergey | Last updated: May 31, 2023 10:45AM UTC

Hi Ben, My bad. It worked. Thanks a lot for the hint.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.