Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Line Breaking Issue in Lab "CSRF where token is tied to non-session cookie"

Mehran | Last updated: Mar 13, 2024 11:57AM UTC

For subject Lab, payload %0d%0a is not working on HTTP 2.0, but its working for HTTP 1.1. Can you please explain this behavior.

Dominyque, PortSwigger Agent | Last updated: Mar 14, 2024 08:14AM UTC

Hi Mehran Can you please clarify/ provide more details on your steps and what you are trying to do? Where are you inserting this payload?

Mehran | Last updated: Mar 14, 2024 12:29PM UTC

while using http 2.0, when we put %0d%0a in URL to add cookie as header injection, it gives error, but if we use http 1.1, we dont get any error Lab link:https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie

Dominyque, PortSwigger Agent | Last updated: Mar 14, 2024 02:10PM UTC

Hi Mehran Can you please email support@portswigger.net with screenshots of your attempt at this so we can see your exact steps?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.