Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Password reset poisoning via middleware: no "GET /forgot-password"

gama | Last updated: May 05, 2022 11:01AM UTC

in the captioned lab, followed the solutions steps. After adding X-Forwarded-Host: xxxx and changing username to Carlos, exploit server showed "GET / HTTP/1.1" and "GET /resources/css/labsDark.css HTTP/1.1" but no "GET /forgot-password". Therefore, not able to obtain the temp-forgot-password-token parameter. The response from repeater showed the same response as from wiener. Using community version and kali linux, both latest. Please check and advise. Thanks

Ben, PortSwigger Agent | Last updated: May 06, 2022 10:22AM UTC

Hi, Are you able to provide us with the full details of the request that you have configured and sent at step 6 of the solution? If it is easier to provide this information via screenshots then please feel free to send us an email to support@portswigger.net. Having just run through this lab, I was able to receive a GET /forget-password request in the exploit server logs so it would be useful to know how you have configured your request.

gama | Last updated: May 06, 2022 11:06AM UTC

thanks. i have re-run the lab. this time, i was able to receive "GET /forget-password" request and complete the solution. no idea why didn't work before. there is practically no change to setings, perhaps the connection is weird sometimes. but great thanks for help. if next time, will take screen shots. thanks

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.