Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Anti CSRF Token

Justin | Last updated: Feb 25, 2022 06:49PM UTC

I keep spending hours on something so simple that should be part of this product... I can't bypass a simple setup like below to perform a scan. GET /comment provide anti csrf value in body let's call it {tokencode} any post request for example POST /comment requires a header called X-CSRF-TOKEN: {tokencode} I tried several plugins, I think I'm not the only person that would struggle with this and don't feel like this is revolutionary. Your product supports passing this into a parameter, why not the request header!

Hannah, PortSwigger Agent | Last updated: Feb 28, 2022 11:30AM UTC

Hi We have an ongoing feature request for this functionality, to which I have added your +1. In the meantime, there are extensions that can provide this functionality. For example, "Add custom header" may be useful. You may also like "TokenJar" or "Authentication Token Obtain and Replace". There are also other extensions to specifically help with CSRF tokens, but it sounds like you may have looked at these already.

Ben, PortSwigger Agent | Last updated: Jun 21, 2022 11:19AM UTC