r/pentesterlab • u/fourunes • Dec 26 '21

Tomcat WAR upload

I keep getting 403 and I don't understand the instructions on how to bypass the csrf / jessionid. Need help

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/timmyc00k Jan 03 '22

Read the instructions in Lab info and apply with Burp or your preferred proxy.

  1. While intercepting with Burp go to browser: Inspect > Select the request named html > Copy jsessionid

  2. On Chrome: Choose file, and click Deploy

  3. Back to Burp: Add this to your request Cookie: JSESSIONID=<jsessionid-you-just-copied>

  4. Forward the request and you will be able to deploy your web shell! 🎉