CSRF
Conditions to exploit an useful CSRF
- Revelant action (CSRF in logout is a boo)
- Cookie based session (if JWT you are done here)
- No unpredictable request parameters
How to find
- Remove CSRF token from request, replace with random value or blank space
- Change POST to GET
- Replace CSRF token with an already used token
- Bypass regex
- Get a token by request and call manually
- Extract the token with XSS or HTML injection
Articles
Generate POCs
- In burp, click in request > engagement tools > generate CSRF poc
Mindmap
