Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CSRF where token is tied to non-session cookie

Allen | Last updated: Mar 12, 2021 08:32AM UTC

In this lab, the first step is to set the csrfkey cookie in a victim's browser. The solution is using a img tag in your exploit page to send a request to set the csrfkey cookie. I tried to send a XMLHttpRequest to do this. But the response is blocked by the browser because of CORS missing allow origin. The request sended by img tag has no origin header, so it worked. But what if the website I attacked detects the referer header, then img tag will not worked anymore I think. Is there any way to send a request without both referer header and origin header?

Allen | Last updated: Mar 12, 2021 02:29PM UTC