csrf-cross-site-request-forgery

CSRF testing involves applying a structured playbook to evaluate state-changing endpoints, token handling, SameSite cookie configurations, and OAuth workflows to identify defense weaknesses. This process uses threat modeling and PoC templates to confirm exploitability.

JSON CSRF forces a victim's browser to send a malicious JSON payload to a vulnerable endpoint. It bypasses standard defenses by exploiting endpoints that accept JSON content-types without proper validation, requiring specific PoC testing to confirm.

Yes, you can analyze SameSite cookie configurations to detect weak defenses and test CSRF bypass techniques. By observing cookie behaviors during state-changing requests, you identify misconfigurations that allow cross-site request forgery despite SameSite restrictions.

Setting up a CSRF test environment requires observing cookies, headers, and CSRF token handling within the target application. You need this structured environment to accurately test state-changing endpoints, SameSite behaviors, and OAuth state weaknesses.

CSRF testing evaluates OAuth workflows by threat modeling login and authorization flows to identify state weaknesses. It applies specific techniques to check if state-changing actions within the OAuth process can be forged across modern web apps.

Test for CSRF-XSS combinations when evaluating applications where cross-site scripting might bypass CSRF token protections. This advanced testing uses proof-of-concept templates to confirm if token fixation and XSS vulnerabilities can be chained together.