Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

Lab: SameSite Lax bypass via cookie refresh -

Jack | Last updated: Jul 17, 2024 08:30PM UTC

I was thinking about this part: "Observe that, after a pause, the CSRF attack is still launched. However, this is only successful if it has been less than two minutes since your cookie was set. If not, the attack fails because the popup blocker prevents the forced cookie refresh. " So AFTER the 2 minutes have passed for lax, we can still exploit csrf? (by making the user manually click the element so the cookie can be forced to be refreshed) Thank you

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.