The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Line Breaking Issue in Lab "CSRF where token is tied to non-session cookie"

Mehran | Last updated: Mar 13, 2024 11:57AM UTC

For subject Lab, payload %0d%0a is not working on HTTP 2.0, but its working for HTTP 1.1. Can you please explain this behavior.

Dominyque, PortSwigger Agent | Last updated: Mar 14, 2024 08:14AM UTC

Hi Mehran Can you please clarify/ provide more details on your steps and what you are trying to do? Where are you inserting this payload?

Mehran | Last updated: Mar 14, 2024 12:29PM UTC

while using http 2.0, when we put %0d%0a in URL to add cookie as header injection, it gives error, but if we use http 1.1, we dont get any error Lab link:https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie

Dominyque, PortSwigger Agent | Last updated: Mar 14, 2024 02:10PM UTC