Is traditional CSRF PoC (e.g. described here) effective for testing in this environment
Specifically if PoC only involved one account - of course, given presence of ADFS SSO...so not counting the final 3 steps described above.
-
The answer to this questions can only be opinions based. Thus it is of of scope.– mentallurgAug 26, 2021 at 18:46
-
@mentallurg can you expand on this? Interested to hear your take...– user265275Aug 26, 2021 at 19:13
-
A 1000000 developers will say it is effective for them, the other 1000000 will say it is not effective for them. All of them will be right. If you use wording like "is effective", "is useful", "is good", "is fast", "is secure", then very likely such question will have opinion based answers. Try to reformulate your question in such way that the answer does not depend on the opinions of those who answer it.– mentallurgAug 28, 2021 at 10:25
Add a comment
|
1 Answer
If the user is already authenticated via ADFS they already have the security token and are already "logged in".
Therefore they will still be vulnerable to CSRF on any website.
I have to admit though, it depends heavily on how exactly the ADFS is configured and its relationship to the website at hand. So there is not enough information here to give a clear answer.
