Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Web Security Academy, Lab: Exploiting cross-site scripting to steal cookies

Jari | Last updated: Nov 22, 2019 02:10PM UTC

Hi, This lab: Exploiting cross-site scripting to steal cookies, might be broken. I can only get my own session cookie sent to me, even with the proposed solution. It seems that the admin is not reading the comments.

Ben, PortSwigger Agent | Last updated: Nov 22, 2019 02:10PM UTC

Hi, I have just tried this lab and was able to solve it using the solution provided. Are you using the payload supplied in the solution? Have you waited for a few seconds before polling the Collaborator to see if a victim has viewed the blog?

Burp User | Last updated: Nov 22, 2019 03:01PM UTC

Hi, I edited my question, but it seems that didn't come through. I'm actually not using Collaborator, instead i have it send the data to my own listener on the internet. Other than that i used the solution provided. When i read the blog myself, i do receive my own cookie, but that is the only traffic i get from this lab and as such i was thinking maybe the bot wasn't reading the blog. Maybe without Collaborator i just need to complete it via CSRF then...

Michelle, PortSwigger Agent | Last updated: Nov 22, 2019 03:05PM UTC