Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Referer strip for CSRF PoC generator

David | Last updated: Jun 19, 2016 03:56PM UTC

Hello, Certain sites check the Referer HTTP header for CSRF protection, but accept request without Referer in order to avoid breaking functionality. One general method to strip the Referer header is to use a <meta name="referrer" content="never"> so in a PoC, it is something like this: <html> <meta name="referrer" content="never"> <body> <form action="https://vistimsite.com/function" method="POST"> <input type="hidden" name="param1" value="1" /> <input type="hidden" name="param2" value="2" /> ... </form> <script> document.forms[0].submit(); </script> </body> </html> Would it be possible to add an option to the CSRF PoC generator like with the "Include auto-submit script" to add this meta tag to the PoC? Thanks, David

PortSwigger Agent | Last updated: Jun 20, 2016 10:13AM UTC

Thanks for this request. We'll look into making Burp include this tag in order to suppress the Referer header.

Rose, PortSwigger Agent | Last updated: Dec 21, 2016 01:58PM UTC

This issue should be fixed in the latest version of Burp. Are you having any issues with this functionality?

Burp User | Last updated: May 13, 2019 05:04PM UTC

This would be a nice, easy addition. Is there any plans to implement this in the near future?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.