CSRF
Conditions to exploit an useful CSRF
- Revelant action (CSRF in logout is a boo)
- Cookie based session (if JWT you are done here)
- No unpredictable request parameters
How to find
- Remove CSRF token from request, replace with random value or blank space
- Change POST to GET
- Replace CSRF token with an already used token
- Bypass regex
- Get a token by request and call manually
- Extract the token with XSS or HTML injection
Articles
| URL | Description |
|---|---|
| What is CRSF | Part #1 |
| Why CORS makes CSRf impossible | Part #2 |
Generate POCs
- In burp, click in request > engagement tools > generate CSRF poc
| URL | Description |
|---|---|
| https://pentestbook.six2dez.com/enumeration/web/csrf | CSRF POCs |
Mindmap
