I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta field. On submission of a form, the same token is URI encoded and sent as an authenticity-token parameter within the POST request body.
The application terminates the user session if the token is invalid, which is the case when running Intruder as the token is single use as expected (not for the life of the user session).
Although it seems straightforward, I've not been able to set with the guides below:
Selecting the request and the appropriate token does not seem to do much but testing the macro results in a new response with a fresh csrf-token. Particularly, authenticity-token is not updated between each request and there is no evidence of the session handling rules working.
I would appreciate a good guide or assistance on this, as I'm not sure what I am missing at this point.