Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Password reset poisoning via middleware: no "GET /forgot-password"

gama | Last updated: May 05, 2022 11:01AM UTC

in the captioned lab, followed the solutions steps. After adding X-Forwarded-Host: xxxx and changing username to Carlos, exploit server showed "GET / HTTP/1.1" and "GET /resources/css/labsDark.css HTTP/1.1" but no "GET /forgot-password". Therefore, not able to obtain the temp-forgot-password-token parameter. The response from repeater showed the same response as from wiener. Using community version and kali linux, both latest. Please check and advise. Thanks

Ben, PortSwigger Agent | Last updated: May 06, 2022 10:22AM UTC

Hi, Are you able to provide us with the full details of the request that you have configured and sent at step 6 of the solution? If it is easier to provide this information via screenshots then please feel free to send us an email to support@portswigger.net. Having just run through this lab, I was able to receive a GET /forget-password request in the exploit server logs so it would be useful to know how you have configured your request.

gama | Last updated: May 06, 2022 11:06AM UTC