Skip to content

Latest commit

 

History

History
45 lines (43 loc) · 1.98 KB

CSRF.md

File metadata and controls

45 lines (43 loc) · 1.98 KB
Raw

Bypassing CSRF Protection

  1. Remove the entire token parameter with value/Remove just the value.
  2. Use any other random but same length token.
  3. Use any other random (length-1) or (length+1) token.
  4. Use attacker's token in victim's session.
  5. Change the method from POST to GET and remove the token.
  6. If request is made through PUT or DELETE then try POST /profile/update?_method=PUT HTTP/1.1 or
POST /profile/update HTTP/1.1
Host: example.com
...

_method=PUT
  1. If token is sent through custom header; try to remove the header.
  2. Change the Content-Type to application/json, application/x-url-encoded or form-multipart, text/xml, application/xml.
  3. If double submit token is there (in cookies and some header) then try CRLF injection.
  4. Bypassing referrer check:
    i. If the referrer header is checked but only when it exists in the request then add this piece of code in your csrf poc: <meta name="referrer" content="never">
    ii. Regex Referral bypass:
https://attacker.com?target.com
https://attacker.com;target.com
https://attacker.com/target.com/../targetPATH
https://target.com.attacker.com
https://attackertarget.com
https://target.com@attacker.com
https://attacker.com#target.com
https://attacker.com\.target.com
https://attacker.com/.target.com
  1. CSRF token stealing via xss/htmli/cors.
  2. JSON Based:
    i. Change the Content-Type to text/plain, application/x-www-form-urlencoded, multipart/form-data and check if it accepts.
    ii. Use flash + 307 redirect.
  3. Guessable CSRF token.
  4. Clickjacking to strong CSRF token bypass.
  5. Type Juggling.
  6. Set the csrf token to "null" or add null bytes.
  7. Check whether csrf token is sent over http or sent to 3rd party. See here
  8. Generate multiple csrf tokens, observe the static part. Keep it as it is and play with the dynamic part.

Reference: