> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/csrf-checklist.md). # csrf checklist #### CSRF bybass methods * NO csrf token * weak csrf token * check content type * check referer header * chnage POST to GET or GET to post #### CSRF token bybass methods * reomving ANI-csrf token * NO check for the users token * weak token * Reasuable token * change request method * Guessable token * Bybass referer #### method attacks * remove referer header and send request and check response * remove original header and send request and check response * remove csrf token and send request and check response #### Basic method no defenses * the request ``` POST /myaccount/changeemail HOST: email=.... ``` * the exploit ```html ``` #### CSRF where token validation depends on token being present * the request ```json POST /myaccount/changeemail HOST: email=....&csrftoken=..... ``` * TIPS: reomve the csrf token -THE exploit ```html ``` #### CSRF where token validation depends on request method * the request ```json POST /myaccount/changeemail HOST: email=....&csrftoken=..... ``` * TIPS: reomve the csrf token * Tips: change request TO GET in CSRF payloads -THE exploit ```html ``` #### CSRF where token is not tied to user session * steps\ 1- create two accounts\ 2- go to the first account and change email we will change\ 3- go to second account and try intersept change email then drop request , copy the csrf token\ 4- go to the first account and put csrf token(second account) and try change email is valid or not #### csrf bypass via method override ``` ``` #### CSRF where token is duplicated in cookie ```html

``` #### CSRF where Referer validation depends on header being present ```html ``` #### CSRF with broken Referer validation ```html ```