Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Reflected XSS protected by very strict CSP, with dangling markup attack - NO HTTP/ DNS from Victim

Saksham | Last updated: May 06, 2024 12:03AM UTC

Hi Team, Hope you are doing well. It might just probably be me, but while solving the lab, I can verify the solution is working for me, if I portrait as a victim, and can see my packets come through, but not for the 'actual simulated victim user'. I've tried all possible solutions for this lab, including new Image.src(), fetch(), location to get a call back with the Victim's CSRF attack but the request never occurs. I can see from the access log, that victim user is clicking on the 'Click Me' button but no requests are coming after that. :( Looking forward to your response. Cheers, S. Arora

Ben, PortSwigger Agent | Last updated: May 07, 2024 08:21AM UTC