Forum Discussion
Exercise "Web Server Brute Force Authentication: Anti-CSRF Tokens" broken?
Is this training really working? Every interaction with the page "Immersive Airport Display Management Systems" displays "csrf token is invalid". From the briefing it sounds all doable, do a get, get the token, send it in the post in a loop with the passwords. But it doesn't work for me at all.
1 Reply
- SamDickison
Community Manager
Mmmmmmmmmmm Instead of doing one GET request and reusing the same token for the entire loop, ensure your script or tool (such as Burp Suite's macros or recursive grep) fetches a fresh token and matching session cookie for every single POST attempt. Adjust your attack to extract a new token right before each login request, and you should bypass that invalidation error!
