LazyCSRF for Burp Suite Improves CSRF PoC Generation

LazyCSRF is a Burp Suite extension that improves the built-in Cross-Site Request Forgery (CSRF) Proof of Concept generator. It addresses common limitations in Burp Suite’s default generator, particularly when handling JSON parameters, HTTP methods such as PUT and PATCH, and requests containing multibyte characters.

Security testers can use LazyCSRF to generate more suitable CSRF test pages without manually correcting certain request-handling and character-encoding issues.

Why Use LazyCSRF?

Burp Suite is widely used for intercepting HTTP traffic and testing web application security. Its built-in Generate CSRF PoC feature helps testers create HTML pages that demonstrate whether a request can be triggered from another origin.

However, the default generator has limitations when dealing with requests that cannot be accurately represented using a standard HTML form. For example, requests containing JSON parameters or using HTTP methods such as PUT may produce an unsuitable PoC. The generated output can also display multibyte characters incorrectly, even when those characters appear correctly inside Burp Suite.

LazyCSRF was developed to address these problems and provide a more practical alternative for generating CSRF PoCs during web application assessments.

Key Features of LazyCSRF

• Automatic XMLHttpRequest generation: Switches to an XMLHttpRequest-based PoC when a request cannot be represented appropriately using a standard HTML form.
• JSON parameter support: Handles requests that use JSON-formatted parameters.
• Additional HTTP methods: Supports generating XMLHttpRequest-based PoCs for PUT, PATCH, and DELETE requests.
• Multibyte character support: Preserves characters such as Japanese text in generated PoCs, provided they are not already corrupted in Burp Suite.
• Community Edition compatibility: Works with Burp Suite Community Edition as well as Professional Edition.

Improved Multibyte Character Display

One of the practical improvements in LazyCSRF is its handling of multibyte characters. Burp Suite’s default CSRF PoC generator may produce garbled text when a request contains characters from languages such as Japanese.

LazyCSRF generates the PoC without introducing the same character-display problem, as long as the original characters are correctly displayed in Burp Suite. This helps testers preserve request data when creating reproducible test cases.

How to Install LazyCSRF in Burp Suite

LazyCSRF is distributed as a JAR file through its GitHub Releases page. Follow these steps to install the extension:

1. Open the LazyCSRF GitHub Releases page.
2. Download the available JAR file.
3. Launch Burp Suite and navigate to the Extensions section under the Extender tab.
4. Select the option to add a new extension.
5. Set the extension type to Java.
6. Browse to the downloaded JAR file and load it into Burp Suite.

After installation, the extension should be available through Burp Suite’s extension menu.

How to Generate a CSRF PoC

LazyCSRF integrates with Burp Suite’s context menu, allowing testers to generate a PoC directly from a captured HTTP request.

1. Capture the target request using Burp Suite’s Proxy or another request-handling tool.
2. Right-click the request to open the context menu.
3. Navigate to Extensions → LazyCSRF.
4. Select Generate CSRF PoC By LazyCSRF.
5. Review the generated PoC and use it within an authorized testing environment.

The extension selects an XMLHttpRequest-based approach for supported requests that are not suitable for conventional form-based PoC generation.

Building LazyCSRF from Source

Developers who want to build the extension themselves can use IntelliJ IDEA or Maven.

Build with IntelliJ IDEA

Open the project in IntelliJ IDEA and navigate to the following menu option:

Build → Build Artifacts → LazyCSRF:jar → Build

IntelliJ IDEA will build the JAR artifact using the project configuration.

Build from the Command Line

LazyCSRF also supports building with Maven. Open the project directory in a terminal and run the appropriate Maven build command configured for the project.

Download LazyCSRF

LazyCSRF provides an alternative to Burp Suite’s default CSRF PoC generator, particularly for JSON-based requests, additional HTTP methods, and multibyte character handling. It can be useful for penetration testers who regularly create CSRF test cases during web application assessments.

Project repository: LazyCSRF on GitHub

Related reading: Explore Burp Suite tutorials and web application testing techniques to learn more about using Burp Suite during security assessments.