Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Password reset poisoning on via my own server

Loan | Last updated: Aug 20, 2022 05:37PM UTC

Hi all, I solved the password reset poisoning lab without any issue. However, I have one question. I would like to be able to reproduce such vulnerabilities in real life penetration testing, that's why I did set up a basic webserver to use like the exploit server delivered by portswigger in the labs. So I tried to have the reset token sent to my webserver in order to view it in the access logs, however, it doesn't work. My webserver doesn't have a domain name so I am providing its ip address as the host header, I wonder if that is the issue (does host header works with ip addresses too in real life?) or maybe this kind of actions are blocked by portswigger. Thanks in advance.

Hannah, PortSwigger Agent | Last updated: Aug 22, 2022 11:03AM UTC

Hi Unfortunately, non-Portswigger domains are blocked from the labs. You could try using the Burp collaborator client instead of the exploit server, in this case.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.