I try to bruteforce paths with Burp intruder but to do so I have to be authenticated and have a valid CSRF token (transmitted as a GET parameter).

So what I want to do is :

  1. Call the login page to get a valid CSRF token
  2. Perform authentication, with CSRF token obtained in 1. (NB: This page returns a 302)
  3. Obtaining a new JSESSIONID thank to 2.
  4. Follow the redirection of 2.
  5. Obtain a new CSRF token on the page targeted by the redirection

At this stage I should have : A valid (authenticated) JSESSIONID A valid CSRF token

Once there, I want to use both of these parameters inside intruder to bruteforce the path structure of the web application (I have a list of paths to test).

However, to get a "valid" path test, I have to set a valid session ID (JSESSIONID cookie), and a valid CSRF token which is passed through a GET parameter, thus, for each of my intruder request, I would like to have the following scheme :

GET /one_path_from_the_list?CSRF=my_csrf_obtained_from_5 HTTP/1.1
Cookie: JSESSIONID=my_session_ID_obtained_from_3

I tried this method, but the CSRF token is never regenerated. Could you help me to solve this ? Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.