Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Referer strip for CSRF PoC generator

David | Last updated: Jun 19, 2016 03:56PM UTC

Hello, Certain sites check the Referer HTTP header for CSRF protection, but accept request without Referer in order to avoid breaking functionality. One general method to strip the Referer header is to use a <meta name="referrer" content="never"> so in a PoC, it is something like this: <html> <meta name="referrer" content="never"> <body> <form action="https://vistimsite.com/function" method="POST"> <input type="hidden" name="param1" value="1" /> <input type="hidden" name="param2" value="2" /> ... </form> <script> document.forms[0].submit(); </script> </body> </html> Would it be possible to add an option to the CSRF PoC generator like with the "Include auto-submit script" to add this meta tag to the PoC? Thanks, David

PortSwigger Agent | Last updated: Jun 20, 2016 10:13AM UTC

Thanks for this request. We'll look into making Burp include this tag in order to suppress the Referer header.

Rose, PortSwigger Agent | Last updated: Dec 21, 2016 01:58PM UTC

This issue should be fixed in the latest version of Burp. Are you having any issues with this functionality?

Burp User | Last updated: May 13, 2019 05:04PM UTC