We have a huge GWT application, which was never tested for security and now we would like to patch it with some of the "best practices" we have found on the GWT website.
One of those patches is related to the RPC XSRF token, so we applied the code so any call in the application will sue the token, and everything "looks" fine, but now I would like to test it against at least a basic attack, just to be sure that "something is working somehow".
The problem is that the request payload seems to be serialized in some custom way, and there is no evidence of the rpc token.
Is there a simple method for testing this vulnerability? I'm thinking about forging a request with postman, or making a form in another server to make a call, but a basic approach to those solution seems not to work.
I've managed a very dirty way to test the functionality, once the
setToken was invoked. I've added a new token string (directly in the code), and the exception is been thrown successfully, so this thing somehow it is working.
Having a way to test it in the wild should be appreciated.