The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Cross-site request forgery" scan doesn't detect anything in the "Lab: CSRF vulnerability with no defenses"

Lieven | Last updated: Feb 06, 2021 03:01PM UTC

Hi, I'm working on the Lab: CSRF vulnerability with no defenses (https://portswigger.net/web-security/csrf/lab-no-defenses). I have been able to solve the lab so no issue there but the "Cross-site request forgery" scan doesn't detect an issue in these page(s). Is this a problem with my scan settings? Regards, Lieven

Hannah, PortSwigger Agent | Last updated: Feb 08, 2021 09:57AM UTC

Hi Lieven I've just run a scan on that lab, with default crawl configuration and adjusted the "issues reported" in the audit configuration to only report cross-site request forgery. My scan did return a tentative informational issue for CSRF. Could you provide some more details on the scan configuration you used?

Lieven | Last updated: Feb 08, 2021 05:52PM UTC

Hannah, so did mine now :( Can you please go buy a shovel and bury this question deep enough for no-one to find... my bad. Sorry to have wasted your time. Regards, Lieven

Hannah, PortSwigger Agent | Last updated: Feb 09, 2021 09:05AM UTC