What do you look to exploit with CSRF?
“Double Submit” CSRF Token method. What areas in a webapp do you look to exploit with CSRF? Anywhere there might be a PUT request on the back-end. You are able to exploit this with a GET request as well, but the odds of finding this in the wild are very small as most devs know better by now.
Is it possible to put or delete a CSRF request?
Assuming a properly locked down CORS policy of course (or none at all which is secure by default). In theory it should not be possible as there is no way to initiate a cross-domain PUT or DELETE request (except for CORS, but that needs a preflight request and thus the target site’s cooperation).
How to exploit cross site request forgery ( CSRF )?
Anywhere there might be a PUT request on the back-end. You are able to exploit this with a GET request as well, but the odds of finding this in the wild are very small as most devs know better by now. Check the account page and see if a password change/reset might be vulnerable.
Is it possible to make a CSRF attack on XMLHttpRequest?
XmlHttpRequest and browser plugins such as Flash/Silverlight/Applets will block cross-domain requests. So, in general, it shouldn’t be possible to make a CSRF attack to a resource that supports PUT/DELETE verbs. That said, the world isn’t perfect. There may be several ways in which such an attack can be made possible :
Can a CSRF attack compromise a web application?
If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. We will see 3 cases where we can use CSRF to exploit Web Applications
How to exploit CSRF on JSON and redirects?
Create a text file called csrf.as containing the ActionScript code given below. Replace the placeholder with the IP address/domain name of the system where the generated flash file will be hosted (attacker server). To compile this file to csrf.swf, simply run mxmlc csrf.as command. This will create a file called csrf.swf.