I am not much experienced with brute force attacks but I was wondering
Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is protected by anti-CSRF token.
Is it possible to do brute force password on the CSRF protected form because a unique key created every time ?
It is written there automated submissions are possible on CSRF protected form but I was thinking If I tried to do brute force than I have to create a valid request.
For example :
than I will use this request to brute force but this anti-CSRF token will expire after a single request than how can a brute force attack brute username and password?