I have been fixing a asp.net web forms application that has a number of vulnerabilities that were discovered by an outside pen testing firm.
I have recently implemented a double submit cookie with the asp.net AntiForgery library. Also setting ViewStateUserKey to use the sessionId.
The pen testers provided a POC CSRF script within an html page. It attempts to upload a file to the website. When I try to use it it does not succeed and invalid viewstate errors are logged on the web server.
I discovered that the pen testers are using a valid login to create the POC script but then they use the same login as the target victim.
Is the POC script not meant to be created from another valid login? Isn't that cheating by using the same login to create the attack script as well as the victim?