Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

CSRF Token

Tengri | Last updated: Jun 11, 2016 03:27PM UTC

Hello, Custom parameter location in response but csrf not writing in response. Why not in the request? Because csrf parameter (_csrf_token=MXnHkkFn_GDk96WoRucoS26JJb4zAQA76jOhdeLG-Uc) in only request. Is it possible to anti csrf? Image: http://s33.postimg.org/oh7x026e7/burp.png Thanks.

PortSwigger Agent | Last updated: Jun 13, 2016 01:46PM UTC

Where does the _csrf_token request parameter come from when you interact with the application in the normal way using your browser? If it is a hidden form field, then Burp's handling of parameters in macros should deal with it automatically if you include a step to fetch the form containing the field? If it is elsewhere, then you can maybe configure a custom parameter location in the prior response to tell Burp where to derive the parameter from.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.