Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria

Andrew | Last updated: Mar 12, 2020 05:47AM UTC

The solution for this lab has an incorrect reference to a .com site instead of the .net site. 11. In Burp Repeater, add the following header, remembering to enter your own exploit server ID: X-Forwarded-Host: your-exploit-server-id.web-security-academy.com Anyone who copy/paste's this step incorrectly instead of using the correct ".net" LAB host name will encounter some strange issues... Solution for step 11 should be: X-Forwarded-Host: your-exploit-server-id.web-security-academy.NET Interesting also that it resolved and forwarded to some other servers....strange!

Michelle, PortSwigger Agent | Last updated: Mar 12, 2020 10:50AM UTC

Hi Thanks for spotting that and letting us know. We'll get that updated!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.