Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Testing ASP.net Anti-Forgery Token

Scott | Last updated: Aug 24, 2022 03:46PM UTC

We have implemented ASP.NET (4.7.2) anti-forgery token and have been testing it. When we modify the token in the post to the API through FireFox, we get a 400 bad request response. However, when we try to do the same thing in Burp Suite through the repeater, we get a success (just modifying the input token and the cookie with random values). We also tried the CSRF PoC functionality as well. Adjusting the token values there also results in success. We even tried to modify the post in a similar manner using Tamper Dev in chrome and get a success each time. The form is a public form which is used as a guest, so no log-in is required. Is there something we may not be doing right or is this just proof that the Anti-forgery token isn't working as expected?

Liam, PortSwigger Agent | Last updated: Aug 25, 2022 09:29AM UTC