I am testing a scenario to find whether an attacker can change the victims email to the attackers by tricking the victims browser to send a POST/PUT request. In this system, the attacker needs to get the CSRF token via a GET request and use it as a HTTP header for POST/PUT to work. I am creating a Java web app and launch it in victim's browser. I am able to get CSRF token, but still trying to find a way to use it as HTTP header to POST/PUT.
- Is this the correct approach to do a PoC for CSRF attack?
- Is it possible to attack using POST or PUT request?