Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Problem with Cache Poisoning Lab

steve | Last updated: Dec 13, 2023 02:21PM UTC

Hello, I'm 90% sure that this lab is broken: https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-cookie I can get the alert to pop-up for myself, but it's as if the user on the other end never receives the xss payload. I followed the instruction to the T and still nothing. I even tried just sending it with intruder for a few minutes just in case it needs time, but still nothing. Also, a bit unrelated to the issue, but relevant to the lab. Why is there a "-" used in the payload? I've never seen this used and it confuses me

Dominyque, PortSwigger Agent | Last updated: Dec 14, 2023 08:42AM UTC

Hi Steve We have just tested the lab and can confirm that it is possible to solve the lab with the given solution. If you are still struggling to solve the lab, you can share a screen recording of your lab attempt to support@portswigger.net so we can see the exact steps you are taking and can then better advise. The use of the "-" is explained here: https://portswigger.net/web-security/cross-site-scripting/contexts

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.