Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp Extension CSRF Token

Casey | Last updated: Jan 09, 2017 05:01PM UTC

Hello, I'm working on an extension where it will automatically grab the last response csrf token and insert it into the HTML header parameter for the POST request. I was able to parse out the CSRF token received from the server in the response; however, for the request how do I access the header parameters? I was able to print the HTTP headers; however, it doesnt include the CSRF portion: def createRequest(self, messageInfo): requestInfo = self._helpers.analyzeRequest(messageInfo) headers = requestInfo.getHeaders() self._stdout.println("Printing headers") self._stdout.println(headers) Here is a sample request: POST /SomePage HTTP/1.1 Host: someserver.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cookie: Some cookie values are set here Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 127 _csrf_form_param=be961302-cdf5-476a-90a7-de222fadffbc&com.blahstuff.morestuff.DO_LOGIN=true&redirectURL=

Burp User | Last updated: Jan 09, 2017 05:13PM UTC

Disregard, I figured out that I was able to access the parameter by analyzing the request.

Burp User | Last updated: Jan 13, 2017 08:47PM UTC