The protection you are speaking is called anti CSRF tokens. These tokens are random values generated by server and which can be used only once ideally (as in this case as well).
AFAIK, you need to write custom Burp Extender to refresh the token each time for making a next request.
Another, easy way to do this is use burp intruder in Pitchfork mode with two lists. This is explained below.
Step 1: (Harvest the CSRF Tokens )
You need to do a lot (equals to number of users x number of passwords you want to test) of GET requests to the login page using
wget/curl and collect the CSRF tokens to a file. Lets call this list as
So, in csrftokens.txt file you will have valid tokens collected above like
Step 2:(Generate a single username+password File)
Take your usernames file (
users.txt) and password file (
password.txt) . Create a list of all possible combinations in the format same as POST request parameters submit.
Lets say the site original post parameters string was like
Here,you create a new file with all possible username,password combinations (
Step3:(Tweak the Burpsuite to defeat anti CSRF tokens)
Now, in burp intruder select Pitchfork mode and edit the post parameters as below
Here, you removed the password field in burp request. This will actually be comming from the
Burp will keep submitting the requests in the format as original post request like below.
This solution needs knowledge of some scripting language for grabbing the tokens. And for generating
user_pass.txt you can use a simple select on mysql database using cross join.
By using the Pitchfork mode you are make sure that you use the token only once and avoid requests getting rejected due to reuse of token.