1

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta field. On submission of a form, the same token is URI encoded and sent as an authenticity-token parameter within the POST request body.

The application terminates the user session if the token is invalid, which is the case when running Intruder as the token is single use as expected (not for the life of the user session).

Although it seems straightforward, I've not been able to set with the guides below:
https://support.portswigger.net/customer/portal/articles/2906338-using-burp-s-session-handling-rules-with-anti-csrf-tokens
https://plusplussecurity.com/2016/11/14/csrf-tokens-using-macros-in-burp-suite-iii/

Selecting the request and the appropriate token does not seem to do much but testing the macro results in a new response with a fresh csrf-token. Particularly, authenticity-token is not updated between each request and there is no evidence of the session handling rules working.

I would appreciate a good guide or assistance on this, as I'm not sure what I am missing at this point.

Improve this question

2 Answers 2

Reset to default
3

Here is the route I took eventually, thanks to the video at https://www.youtube.com/watch?v=GWLMmkv3z38:

  1. Identify the anti-CSRF token (e.g. hidden csrf_token field within the form)
  2. Go to Project options > Sessions > Add to record a new macro.
  3. In Macro Recorder, select the HTTP request from the proxy history and click "OK".
  4. Select the Macro Item and hit configure item.
  5. In the bottom right, Add Custom Parameter, highlighting the string that will be extracted for use as the anti-CSRF token. The 'Define start and end' fields should be updated with the appropriate search terms. Populate the Parameter name field, with the description like csrf-token.
  6. Add session handling rule.
  7. Add a rule action (Run a macro) from the dropdown list.
  8. Select Update current request with parameters matched from final macro response.
    Select update only the following parameters and enter the name of the parameter e.g. authentication_token.
  9. Finally, click the Scope tab within the Session handling rule editor and configure scope to the Burp Tools, Parameters and scope URLs desired.

I spent more time than I wanted on this issue so I hope this helps someone save some pain; if it's not clear let me know and I'll try to fill in the gaps.

Improve this answer
3
  • Thanks a lot for providing the solution. Sometimes ago I wanted to automate a workflow where we would provide a list of username and passwords, and after authentication is successful, the user needed to submit a form. Eventually I gave up on Burp because I couldn't automate the workflow. Such things are not obvious with Burp the first time around but your solution will definitely help in some situations.
    – void_in
    Oct 23, 2018 at 5:18
  • Thanks @void_in, what did you use instead of Burp?
    – user1330734
    Oct 23, 2018 at 21:50
  • We used Apache jmeter record session and then replay the whole session.
    – void_in
    Oct 24, 2018 at 11:07
0

Sounds like you are on the right lines. There isn't a more detailed tutorial than the one you linked.

To help you diagnose what's going wrong, open Sessions Tracer. Also, send a request to Repeater that has an authenticity token. What you want to see is that when you press Go in Repeater, the session handling rule activates, runs a macro to fetch a fresh token, and updates the request in Repeater. Knowing exactly which part of this isn't working should help you fix it.

Because the token is in a meta tag you will need to use a custom parameter location. In Macro Editor, click Configure Item, then add a Custom parameter location.

Alternatively, use Burp 2 which should handle this automatically.

Improve this answer
2
  • Thanks for the response, can you elaborate on how Burp 2 handles this case automatically? I have tried the burpsuite_pro_v2.0.09beta.jar package, there is no indication that it is handling these tokens automatically.
    – user1330734
    Oct 22, 2018 at 3:03
  • @user1330734 - If you do a crawl & audit in Burp 2, the crawler understands state and should realize that it only gets to the forms success state via a fresh CSRF token. If this isn't working, we'd be keen to work with you to debug that. Please email what information you have to [email protected]
    – PortSwigger
    Oct 22, 2018 at 11:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .