Burp Suite User Forum

Create new post

"Cross-site request forgery" scan doesn't detect anything in the "Lab: CSRF vulnerability with no defenses"

Lieven | Last updated: Feb 06, 2021 03:01PM UTC

Hi, I'm working on the Lab: CSRF vulnerability with no defenses (https://portswigger.net/web-security/csrf/lab-no-defenses). I have been able to solve the lab so no issue there but the "Cross-site request forgery" scan doesn't detect an issue in these page(s). Is this a problem with my scan settings? Regards, Lieven

Hannah, PortSwigger Agent | Last updated: Feb 08, 2021 09:57AM UTC

Hi Lieven I've just run a scan on that lab, with default crawl configuration and adjusted the "issues reported" in the audit configuration to only report cross-site request forgery. My scan did return a tentative informational issue for CSRF. Could you provide some more details on the scan configuration you used?

Lieven | Last updated: Feb 08, 2021 05:52PM UTC

Hannah, so did mine now :( Can you please go buy a shovel and bury this question deep enough for no-one to find... my bad. Sorry to have wasted your time. Regards, Lieven

Hannah, PortSwigger Agent | Last updated: Feb 09, 2021 09:05AM UTC

Hi Lieven I'm glad you managed to pick it up! Have a good week :)

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.