I am testing an application that doesn't use anti-csrf tokens for its requests. There are no users defined for this application as well. Well, in that case, how to carry out testing for csrf in this particular application?
This question is not a duplicate as you are asking how to test for it.
In just the same way you would test for normal CSRF. Instigate a request to the server that would simulate the request arriving cross-domain. That is:
refererheaders appropriately set.
- No headers present that cannot be set cross-domain (e.g.
- No tokens present that an attacker cannot determine without crossing origins in the browser session.
Of course you can always test for it by actually hosting your own page to make a cross-domain request to the site you are testing (being careful to strip any additional tokens that wouldn't be known of course).