The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

SSRF via flawed request parsing

Noam | Last updated: Feb 01, 2023 09:51PM UTC

This lab requires users to brute force the IP in the host header to find the admin panel. My issue is that, even when following the solution and community solutions, intruder is not able to brute force the IP. Target: https://labid.web-security-academy.net Positions: GET https://labid.web-security-academy.net/ HTTP/1.1 Host: 192.168.0.§0§ Payloads: Numbers -> From: 0 -> To: 255 -> Step: 1 My Burp is at its latest version. Therefore, either something is broken with Burp, or I am missing something Thanks

Ben, PortSwigger Agent | Last updated: Feb 02, 2023 11:41AM UTC