Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Academy - CSRF with token is duplicate or token tied to non-session cookie

kd | Last updated: Apr 18, 2023 08:52AM UTC

Hi, I was just trying to solve the Labs for the CSRF-Challenges, but for some reason, I always got the error 'Invalid CSRF-Token', even though I submited the exact solution that is provided to the Lab. When I just tried to deliver the exploit to the victim, I suddenly got the message 'Lab solved', even though it was not working at my end! Could it be, that some things changed maybe for my Browser or something? I am using Firefox v112.0... Well I am glad it worked now, but also a bit sad I could not really test it and it was quite frustrating to solve this lab...

Ben, PortSwigger Agent | Last updated: Apr 18, 2023 04:38PM UTC

Hi, Are you able to share the payload that you are delivering for one of these labs so that we can see how you have set this up? I have just run through the 'CSRF where token is duplicated in cookie' lab and it does appear to be working as expected so it would be good to see exactly what you are doing so that we can assist you further.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.