1

I am testing a scenario to find whether an attacker can change the victims email to the attackers by tricking the victims browser to send a POST/PUT request. In this system, the attacker needs to get the CSRF token via a GET request and use it as a HTTP header for POST/PUT to work. I am creating a Java web app and launch it in victim's browser. I am able to get CSRF token, but still trying to find a way to use it as HTTP header to POST/PUT.

  • Is this the correct approach to do a PoC for CSRF attack?
  • Is it possible to attack using POST or PUT request?
  • How are you able to get the CSRF token? This shouldn't be possible on a secure site. Knowing how you achieved that might help answer the question (the same issue that allows you that may potentially be used to send POST/PUT request with a custom header, which also should not be possible in a normal scenario). – tim Mar 28 at 12:44
2

Assuming the target website have a permissive cross origin resource sharing configuration or you found XSS on the target website (I guess it's how you got that token from), you could just make an AJAX request specifying your custom XSRF header.

$.ajax({
  type: "POST",
  beforeSend: function(request) {
    request.setRequestHeader("XSRF-Token", yourToken);
  }
 [...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.