Burpsuite Pro: CSRF tokens in sequencer

Question

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF.

Let's say a website has a url in it's site protected by a Token:

<a href="http://example.com/mypage.TOKEN=1234"> somelink</a>

The problem I'm facing is that the token remains the same if I do multiple requests. It only expires (it changes) if it gets used.

Now I'm trying to capture a number of tokens with burp. The problem is that if I request the same page with sequencer the token hasn't changed because there hasn't been a link visited that uses that token ( the token hasn't expired yet ). How can I make Burp extract the token value and use it in it's next sequencer request.

Answer 1

Try to use Makros at: Options -> Sessions -> Session Handling -> Add -> Rule Actions and enable the Sequencer at the Scope Tab within the Session handling rule editor. Looks like you have to define Makros to "visit the Link" aka call the URL the link points to with the given Token. Look around the Sessions-Tab for the appropiate way to accomplish the task.