The statement, "every site without a CSRF token is vulnerable to a CSRF attack", is not accurate. It certainly does not apply to static websites that have no server-side functionality, where CSRF is not even applicable/possible. Additionally, the OWASP CSRF Prevention Cheat Sheet mentions some other CSRF-prevention mechanisms that do not use CSRF tokens:
Adding CSRF tokens, a double submit cookie and value, encrypted token,
or other defense that involves changing the UI can frequently be
complex or otherwise problematic. An alternate defense which is
particularly well suited for AJAX endpoints is the use of a custom
request header. This defense relies on the same-origin policy (SOP)
and only within its origin. By default, browsers don't allow
A particularly attractive custom header and value to use is:
Sometimes it's easier or more appropriate to involve the user in the transaction in order to prevent unauthorized transactions (forged or otherwise).
The following are some examples of challenge-response options:
- Re-Authentication (password or stronger)
- One-time Token
Otherwise, any web application that doesn't implement any of these mechanisms and does have HTTP GET or POST requests that initiate actions may be vulnerable.
CSRF and CORS are rather separate concepts even though there is some similarity, at least at the root of it all.
CORS, or Cross-Origin-Resource-Sharing allows a server to define a policy of which origins (other domains) may retrieve information from it. Even though the default policy prevents another origin from reading data, it does not prevent a CSRF attack from succeeding.
Please share your methodology if possible, like what will you test for
if you don't find a site with crsf token? how will you check if it has
one or not?
You can check for a CSRF token by examining cookies, the request body, and the HTML, although it may depend on the specific system used.
You can test for CSRF vulnerabilities by crafting a test HTML page that attempts to perform sensitive requests towards the website in question.