I am testing an application that send XML data as body in POST request. The application is not using any CSRF token Is there any way to perform CSRF in this case. XHR does not works in latest browsers, as it blocks CORS requests. One link i came across but is not working. http://pentestmonkey.net/blog/csrf-xml-post-request Any way to achieve this?