Custom action worked example - Port Swigger
Summary: PortSwigger published a worked example of a Burp Repeater custom action, a Java script that runs directly in Repeater to automate tasks during manual testing. The script reads the HTTP response body as a string, checks for the string csrf=, extracts the 16-character token that follows its last occurrence, replaces certain characters in it, and logs the modified token to the Custom actions Output panel, or logs "No CSRF token" if the string is absent.
What's compelling: The example shows that a short script attached to Repeater can pull a CSRF token out of a response and alter it automatically, which puts token handling in the hands of whoever is running the test rather than a fixed scanner rule.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026