Exercise "Web Server Brute Force Authentication: Anti-CSRF Tokens" broken?

Mmmmmmmmmmm​ Instead of doing one GET request and reusing the same token for the entire loop, ensure your script or tool (such as Burp Suite's macros or recursive grep) fetches a fresh token and matching session cookie for every single POST attempt. Adjust your attack to extract a new token right before each login request, and you should bypass that invalidation error!