CSurfer
Summary: CSurfer is a Burp Suite extension, version 1.1a by A. Saafan and last updated 22 June 2023, that automatically handles anti-CSRF tokens and hides the mechanism from the browser or other tool using Burp. It tracks the most recent token received in a response and ensures each request contains the latest token, and it lets Burp be chained as an upstream proxy from scanning tools that are not CSRF-aware.
Why it matters: The extension is third-party code that PortSwigger explicitly makes no warranty about for quality or usefulness, and it requires Java version 7 - a version a security leader should weigh before placing it in the request path of scanning tools.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026