I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not happening in IE. I am able to exploit and perform a state change action in Internet Explorer. What is the reason for this behavior??
-
Which IE version?– Benoit EsnardAug 13, 2019 at 9:30
-
Its IE 11 (11.1268)– RaghavAug 13, 2019 at 9:55