i.e. something like;
var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = req.getAllResponseHeaders(); console.log(headers);
But instead of reading HTTP response headers (as per snippet above), it reads the HTTP request headers?
X-CSRF-TOKEN) included within a specially crafted HTTP request which is accepted by the server and therefore bypasses the flawed CSRF protection mechanism in order to execute CSRF.
I have elaborated on this in slightly further detail below (please excuse any duplicated details);
X-CSRF-TOKEN) via the XmlHttpRequest (or whatever). I just need to be able to read the
X-CSRF-TOKEN HTTP request header that is set in the HTTP request (not response), extract this value, and include within a XmlHttpRequest (or whatever) to craft a request that will be accepted by the server in order to bypass the faulty anti-CSRF mechanism and successfully perform CSRF.
I have written an exploit for this but it pertains to HTTP response header cookie values within the HTTP response headers, but this obviously doesn't work as the
XSRF-TOKEN cookies are not used in this context for anti-CSRF. It's the
X-CSRF-TOKEN HTTP Request header that is used for the anti-CSRF mechanism. I was thinking I could do something like
req.open('GET', document.location, false); Again since this will be executing under the context of the victim user, shouldn't it be trivial to scrape the
X-CSRF-TOKEN HTTP request header here while submitting something like
req.open('GET', document.location, false);?
Any help will be much appreciated. I hope I have explained this well enough for you to understand what it is I'm trying to do (it's late here).
Thank you for your time, /J