Skip to content

Update CSRF.md #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nm17 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update CSRF.md #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion Methodology/CSRF.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,6 @@
### CSRF
# CSRF

- Check if the framework used by the app uses any kind of CSRF protection built in.
- Remember that "Any application that accepts HTTP requests from an authenticated user without having some control to verify that the HTTP request is unique to the user's session.". Try to find requests that doesn't send any cookies or params that look like a csrf token.
- Check how and by what endpoint the token is being generated.
- Check if the token is statefull (The token is stored somewere on the server) or is stateless (the token is validated using some kind of algorithm).