All Questions
4 questions
0
votes
0
answers
683
views
JSON-CSRF using Flash SWF Doesn't make POST request
I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission.
So, I have read these ( before asking here ):
Vimeo hackerone Report by avlidienbrunn
...
- 121
4
votes
1
answer
821
views
CSRF Bypass using ActionScript via weak CrossDomain.xml
I have a target which has weak CrossDomain.xml but it prevents CSRF attack looking at one of the custom HTTP headers. I found following actionscript on a couple of websites, which works perfectly ...
- 51
4
votes
2
answers
2k
views
The Spring Security framework recommends against using double-submit cookies to prevent CSRF. Is their concern legitimate?
I was about the Spring Security framework's CSRF protection to see how it works. Spring doesn't use the double-submit pattern, but instead associates the CSRF token with the user's session. The ...
- 198
4
votes
1
answer
1k
views
CSRF and Flash/Flex
Flash and Flex clients can make RPC calls to a server using the NetConnection and AMF protocols. It's not uncommon to have these RPC calls setup to authenticate based on a cookie.
I've heard ...
- 185