Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF.

Let's say a website has a url in it's site protected by a Token:

<a href=""> somelink</a>

The problem I'm facing is that the token remains the same if I do multiple requests. It only expires (it changes) if it gets used.

Now I'm trying to capture a number of tokens with burp. The problem is that if I request the same page with sequencer the token hasn't changed because there hasn't been a link visited that uses that token ( the token hasn't expired yet ). How can I make Burp extract the token value and use it in it's next sequencer request.

share|improve this question
up vote 3 down vote accepted

Try to use Makros at: Options -> Sessions -> Session Handling -> Add -> Rule Actions and enable the Sequencer at the Scope Tab within the Session handling rule editor. Looks like you have to define Makros to "visit the Link" aka call the URL the link points to with the given Token. Look around the Sessions-Tab for the appropiate way to accomplish the task.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.