Does CSRF work with POST request?
Applications can be developed to only accept POST requests for the execution of business logic. The misconception is that since the attacker cannot construct a malicious link, a CSRF attack cannot be executed.
Is JSON CSRF possible?
Yes, it is possible. You can setup an attacker server which will send back a 307 redirect to the target server to the victim machine. You need to use flash to send the POST instead of using Form. It also works on Chrome.
What is JSON CSRF?
The application/json MIME type is typically sent using AJAX, which is prevented from being sent in cross-site requests by the Same-Origin Policy (SOP). Thus, to perform CSRF against a JSON endpoint, we need to either use a different MIME type, exploit a weak CORS policy, or find another means of submitting the request.
What is CSRF PoC?
This function can be used to generate a proof-of-concept (PoC) cross-site request forgery (CSRF) attack for a given request. When you execute this function, Burp shows the full request you selected in the top panel, and the generated CSRF HTML in the lower panel.
What’s the difference between CSRF and cross site request forgery?
The method; i.e. put, post, delete, request, get etc., of sending data is irrelevant. A CSRF (Cross Site Request Forgery) attack allows for un-trusted content to be injected and processed by the web server.
Is it possible to put or delete a CSRF request?
Assuming a properly locked down CORS policy of course (or none at all which is secure by default). In theory it should not be possible as there is no way to initiate a cross-domain PUT or DELETE request (except for CORS, but that needs a preflight request and thus the target site’s cooperation).
Is it possible to make a CSRF attack on XMLHttpRequest?
XmlHttpRequest and browser plugins such as Flash/Silverlight/Applets will block cross-domain requests. So, in general, it shouldn’t be possible to make a CSRF attack to a resource that supports PUT/DELETE verbs. That said, the world isn’t perfect. There may be several ways in which such an attack can be made possible :
Is it possible to CSRF a REST API endpoint?
Rest API endpoints have a very important difference from other requests: they are specifically stateless, and should never accept/use data from either a cookie or session. If that is how you define “REST API”, then no CSRF is possible.