botesjuan/burp-suite-certified-practitioner-exam-study

Burp Suite Certified Practitioner Exam Study

burp-suite-certified-practitioner-exam-study's Issues

contact information

Hi

I am preparing for this certification, but I have encountered some problems and would like to ask for your advice, is there any way I can contact you?

I've tried to follow you on Twitter or Linkedin, but I can't get in touch to you, is there any way I can contact you?

[additional tips] host injection and xxe

Sorry i was a bit lazy to write a PR.

Here's a few more tips that may be useful:

• When spoofing host header on password reset using "Host:" or "X-Forwarded-Host:", if you receive the error "Invalid hostname", try using the following hostname: xxx.oastify.com?legit-host.web-security-academy.net without a slash.
• If you can inject in an XML file and you can't find a way to perform an XXE, think about OS command injection using $() or backticks.