I try to bruteforce paths with Burp intruder but to do so I have to be authenticated and have a valid CSRF token (transmitted as a GET parameter).
So what I want to do is :
- Call the login page to get a valid CSRF token
- Perform authentication, with CSRF token obtained in 1. (NB: This page returns a 302)
- Obtaining a new JSESSIONID thank to 2.
- Follow the redirection of 2.
- Obtain a new CSRF token on the page targeted by the redirection
At this stage I should have : A valid (authenticated) JSESSIONID A valid CSRF token
Once there, I want to use both of these parameters inside intruder to bruteforce the path structure of the web application (I have a list of paths to test).
However, to get a "valid" path test, I have to set a valid session ID (JSESSIONID cookie), and a valid CSRF token which is passed through a GET parameter, thus, for each of my intruder request, I would like to have the following scheme :
GET /one_path_from_the_list?CSRF=my_csrf_obtained_from_5 HTTP/1.1 Cookie: JSESSIONID=my_session_ID_obtained_from_3
I tried this method, but the CSRF token is never regenerated. Could you help me to solve this ? Thanks