Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Never get x-cahe: hit on the lab "Targeted web cache poisoning using an unknown header"

Edwin | Last updated: May 31, 2024 11:02PM UTC

Hi guys, After discovering the unknown header with Param Miner extension and trying lot of times, I cannot get in the response x-cache: hit even following the solution in the lab description and searched in other sources. Basicaly the methology is the same as you have stated in the solution in the lab description. In one try, the lab server became off and never get the intended response header. This is an example of my request I am sending in the Repeater tab. Do you see any wrong that you can see which is the cause I cannot get the response header x-cache: hit ? GET / HTTP/1.1 Host: 0ac700610491e96081e111ab00c50015.h1-web-security-academy.net X-Host: exploit-0a55007b043ee9cb81b210a3014b0093.exploit-server.net X-Cache: hit Cookie: session=B4KxhdyCTlt1EzgCmRPA70VHccFg2Z6h Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="125", "Not.A/Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: es-419,es;q=0.9 Priority: u=0, i Connection: keep-alive Best regards, Edwin.

Edwin | Last updated: Jun 03, 2024 05:44AM UTC

I guess every lab has its time in order to solve it, right? Well, in past week I finished that time sending repeatedly requests from Burp Repeater and never got the (in)famous response header x-cache:hit Is normal this behaviour? Thank you in advance for any advice. Best, Edwin.

Ben, PortSwigger Agent | Last updated: Jun 03, 2024 08:27AM UTC

Hi Edwin, Do you still have Param Miner loaded and in use when you try to manually send requests to the lab?

Edwin | Last updated: Jun 03, 2024 06:02PM UTC

Hi Ben, Thank you so much for replying to my messages, really appreciated. <3 Yes, I have Param Miner loaded and in use when I am sending manually every request from Burp Repeater. In some videos I have seen that at the second try the have 7 or 13 hit, I guess there is a pause in the video up to the backend server respond with x-cache: hit Here is the image of Target tab, where I can see discovered header: https://postimg.cc/zVmFbg7W Here is the image of Burp Extensions tab, where I can see the same discovered header and a little more of information in the "log" and you can see that Param Miner is loaded: https://postimg.cc/Ffj28LpQ Perhaps there is a clue for you in the meaning of "Resuming header bruteforce at -1 on URL-Lab" Thank you for your help. Best regards, Edwin.

Edwin | Last updated: Jun 03, 2024 06:27PM UTC

Hi Ben, This is my current try in the Lab: https://postimg.cc/QFFQ8F69 With Param Miner loaded and runing and sending manual requests from Burp Repeater, any success yet. Days before, tried sending automated requests with Burp Intruder but no positive results there either. Best regards, Edwin.

Edwin | Last updated: Jun 03, 2024 06:53PM UTC

Hi Ben, Sorry for consecutive messages. But, again time expired from the Lab while sending manual requests from Burp Repeater and never got x-cache: hit response header. No more responses from server: https://postimg.cc/FdFsvBm9 Refreshing browser tab where Lab was seen: https://postimg.cc/XZLxXrMw Thank you in advance for any help or suggestion. Edwin.

Ben, PortSwigger Agent | Last updated: Jun 04, 2024 06:49AM UTC

Hi Edwin, The default settings for Param Miner will add a cache buster to the requests that you are sending via Repeater which will interfere with how this lab works. If you disable the use of Param Miner when you are carrying out the manual phase of this lab, are you then able to poison the cache?

Edwin | Last updated: Jun 07, 2024 06:55AM UTC