Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Anti-CSRF Token Question

AA | Last updated: Sep 12, 2023 09:07AM UTC

In order to brute force the main login page of DVWA, I followed the guide given here: https://portswigger.net/support/using-burp-suites-session-handling-rules-with-anti-csrf-tokens It did work but I have a few questions as to how and why it works. When I make the macro, I tell it what are the custom parameter locations in the file which it extracts based on some regex (as far as I understand). Let's say I extract user_token from some hidden input field based on some regex. But how does Burp automatically know to insert it into the POST parameter user_token? In the Session Handling Action Editor, I see an option "Update current requests with parameters matched from final macro response" unchecking which stops it from working. But how does it know which field to populate with what?

Michelle, PortSwigger Agent | Last updated: Sep 12, 2023 01:10PM UTC