I am testing an application that send XML data as body in POST request. The application is not using any CSRF token Is there any way to perform CSRF in this case. XHR does not works in latest browsers, as it blocks CORS requests. One link i came across but is not working. http://pentestmonkey.net/blog/csrf-xml-post-request Any way to achieve this?

  • There are many questions on this site that discuss issues along these lines. This answer will probably help: security.stackexchange.com/a/166798/149676 Commented Aug 10, 2017 at 13:02
  • 1
    Do you require a particular Content-Type or just an XML-formatted body?
    – Arminius
    Commented Aug 10, 2017 at 13:06
  • Yes, it requires Content-type as text/xml only. If it was accepting any content-type, text/plain would have worked,
    – PenGeek
    Commented Aug 10, 2017 at 18:38
  • you can't use POST from a CSRF alone. Unless the server allows GET you need XSS to do it via ajax...
    – dandavis
    Commented Aug 11, 2017 at 3:22


You must log in to answer this question.

Browse other questions tagged .