Let's take another look at a CSRF vulnerability on webscantest.com. Here's the form we'll be testing:
Simple enough. Fire up the Burp proxy and make sure the Intercept feature is on, let's fill in the form with a nice test value:
As a sidenote, Cyan is really cool – in the subtractive color system, Cyan is a primary color and can be created by removing red from white light. Let's submit this form and then check back with Burp to see the intercepted request:
OK, noting the important information – the HTTP request method, the form encoding, the field data, and so on – let's take a look at what happens when we turn Intercept off and allow the POST request to resolve:
Here's what a successful submission looks like. Critically for us, we can see what value the form submitted through the...
