Cross-Site Request Forgery test case

2 min readMar 19, 2021

Cross-site request forgery(csrf) also known as one-click attack or session riding is type of attack where application server accept the request without checking its origin or force user to perform malicious task on behalf of attacker.

concept– Lets imagine user(victim) is logged in website(A) and surfing the internet side by side in other tab of browser, while surfing internet user get popup and redirect to malicious website(B), now suppose that attacker have added some html code in website(B) so when victim visit website(B) it send forge request to website(A) and if server(website A) does not have any csrf protection then website(A) accept the request and execute the forge request.

How to bypass CSRF Protection-

Change HTTP method –

if authenticated request sent via POST,PUT,DELETE method> change this request to GET and POST

2. Token implemented in request –

If website have csrf token in request that does mean site is not vulnerable to csrf >try following test cases to check site is vulnerable or not-

Remove the token from request including csrf_token parameter
Insert null value “%00” in csrf parameter or type “undefined”
Replace other user token and use it
Check token length and sent random value with same length
Try to guess token pattern or decode/crack the token

3. Referer , Origin Header bypass –

Sometime developer use referer/origin header to protect site from csrf attack>steps to bypass this-

Remove the header
Add this code in your payload-

<meta name=”referrer” content=”no-referrer”>

4. Json content-type Csrf –

please read geekboy blog for this

Link- https://www.geekboy.ninja/blog/tag/json-csrf/

Hackerone Report-

Cross-Site Request Forgery test case

Written by Suraj Dubey