Web Hacking Tips
  • Web App Hacking Tips & Tricks
  • Weekly Tips
    • Week 1 - XSS Filter Evasion
    • Week 2 - CSRF Token Bypass
    • Week 3 - CORS Exploitation
    • Week 4 - Finding XSS
    • Week 5 - CSRF Explanation
    • Week 6 - XSS Types
    • Week 7 - Advanced SQLMap
    • Week 8 - Stealing HttpOnly Cookies from PHPINFO
    • Week 9 - SQLMap Tamper Scripts
    • Week 10 - XSS Obfuscated Payloads
    • Week 11 - XS-Search: Cross-Origin Enumeration
    • Week 12 - Subdomain Takeovers
    • Week 13 - XSS Keylogger
    • Week 14 - Algolia API Keys
    • Week 15 - GraphQL Introspection
    • Week 16 - Naming BurpSuite Repeater Tabs
    • Week 17 - GoBuster Tips
    • Week 18 - Burp Request to Python Script
    • Week 19 - Customizing Nikto Scans
    • Week 20 - Google Phishing Page
    • Week 21 - Google BITB
    • Week 22 - XSS Through SVG File
    • Week 23 - FoxyProxy Extension
    • Week 24 - CSP Bypasses
    • Week 25 - Pilfering LocalStorage with XSS
    • Week 26 - Cloud SSRF
    • Week 27 - Blind XSS
    • Week 28 - Firebase Misconfigurations
    • Week 29 - XSS to CSRF
  • Week 30 - SQLMap Debugging
  • Week 31 - WayBack Machine
  • Week 32 - O365 BITB
  • Week 33 - Burp Intruder Attacks
  • Week 34 - GraphQL Bruteforcing
  • Week 35 - User Accounts
  • Week 36 - CVE Submission
  • Week 37 - Second Order SQLi
  • Week 38 - Out of Band SQLi
  • Week 39 - Broken Link Hijacking
  • Week 40 - JWT Testing
  • Week 41 - BURP ATOR
  • Week 42 - ProxyChains
  • Week 43 - CSS Keylogging
  • Week 44 - SVG SSRF
  • Week 45 - Request Smuggling
  • Week 46 - XSS Payloads
  • Week 47 - DNS Re-binding
  • Week 48 - SSRF Bypass
  • Week 49 - File Upload Bypass
  • Week 50 - CRLF Injection
  • Week 51 - HTML to PDF
  • Week 52 - Parameter Pollution
  • Week 53 - Pre-Account Takeover
  • Week 54 - Race Conditions
  • Week 55 - SQLi to RCE
  • Week 56 - Cloud SSRF PrivEsc
  • Week 57 - Response Queue Poisoning
  • Week 58 - Directory Traversal
  • Week 59 - File Upload -> CSRF
  • Week 60 - Modern CSRF Attacks
Powered by GitBook
  1. Weekly Tips

Week 2 - CSRF Token Bypass

CSRF Token Bypass Using BurpSuite

Continuing the Web App Hacking Tips & Tricks series, this week’s tip focuses on bypassing CSRF tokens.

Have you ever found a web endpoint that’s vulnerable to SQL injection, but uses a CSRF token that makes SQLMap automation difficult?

Boy, have we got a show for you!

It turns out you can set a macro in BurpSuite to retrieve a valid CSRF token, and instantly add it to the request being intercepted through the proxy. To do so, follow the below steps:

  1.  Launch Burp and Intercept the HTTP Request of the page containing the CSRF token.
  2.  Go to Project Options -> Sessions -> Macros and click the Add button
  3.  Select the Intercepted HTTP Request and press OK
  4.  Select ‘Configure item’ and press Add
  5.  Scroll through the HTTP Response and select the CSRF token (see below screenshot). Don’t forget to name the Parameter based upon where the CSRF token is being used (GET or POST).
  6.  Press Ok to create the macro
  7.  Scroll up to ‘Session Handling Rules’ and press Add
  8.  In ‘Rule Actions’ press Add and ‘Run a macro’. Select your macro.
  9.  Move over to the Scope tab and add the target domain in the URL Scope. Don’t Forget to Check the ‘Proxy (use with caution)’ box at the top.
  10. Press OK and you’re done!

Now to put your Macro to work, use the following SQLMap syntax to proxy traffic through Burp:

sqlmap -u --proxy=”http://localhost:8080”

That’s it!! Now CSRF tokens will no longer prevent you from dumping a DB.

PreviousWeek 1 - XSS Filter EvasionNextWeek 3 - CORS Exploitation

Last updated 2 years ago

Page cover image