Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Report on CSRF Vulnerabilities

Dave | Last updated: May 05, 2015 06:12PM UTC

Hello. I am trying to learn Burp Pro after one of my colleagues left without leaving much information around the Burp testing he had done. I have an application with a known CRSF vulnerability AND an older Burp report indicating the CRSF vulnerability. I am trying to reconfigure the Burp environment and regenerate the report, but without any luck. I can replicate the other vulnerabilities, but I cannot get same CRSF item to list out again. I have included the CSRF Scanner extension and tried using the CSRF PoC, but neither show up in the scan report. I am trying to figure out if this is a wording change or if I am missing something. My current reports cover vulnerability 2098944 "Cross-site request forgery" but the old report indicated type "Request vulnerable to Cross-site Request Forgery" and "Form does not contain an anti-CSRF token." If these can only be identified manually, is there something beyond the CSRF PoC that I need to be using to capture them within the report? Thanks.

PortSwigger Agent | Last updated: May 06, 2015 10:20AM UTC