Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Web Security Academy bug

György | Last updated: Dec 30, 2022 04:36PM UTC

Hi there. The Web shell upload via path traversal challenge seems to be broken for me right now. I got to the point where I have uploaded a working PHP web shell and I can execute cat /home/carlos/secret and I get back the response. Yet, the secret is not accepted as valid ("That answer is incorrect, please try again!"). I certainly have the shell in place, I ran a couple of other commands like id, date, and uname -a (giving Linux d0253ec50041 4.14....) I reproduced this on a fresh container too so I guess there might be something going on with solution validation for this challenge?? Anyhow, just wanted to let you know. Otherwise huge kudos and respect for the platform and for making it available for free!! <3 Cheers, Gyuri

Ben, PortSwigger Agent | Last updated: Jan 02, 2023 02:18PM UTC

Hi Gyuri, Are you able to share details of what your web shell looks like so that we can take a look at this for you? Out of interest, what does an example of the secret returned from your shell look like?

György | Last updated: Jan 08, 2023 09:05PM UTC

The shell was simply <?php print(system($_GET['q'] )); ?>

György | Last updated: Jan 08, 2023 09:20PM UTC

A sample secret was: VojQsgT7PjHTiNXYsMi2eUKwACTynvhdVojQsgT7PjHTiNXYsMi2eUKwACTynvhd I tried again with another PHP webshell upload challenge, had the same issue basically.

Ben, PortSwigger Agent | Last updated: Jan 09, 2023 07:59AM UTC

Hi György, It looks like your shell is printing the secret out twice i.e. you are getting 'VojQsgT7PjHTiNXYsMi2eUKwACTynvhdVojQsgT7PjHTiNXYsMi2eUKwACTynvhd' when the actual secret is 'VojQsgT7PjHTiNXYsMi2eUKwACTynvhd'

György | Last updated: Jan 09, 2023 11:00AM UTC