# csrf checklist #### CSRF bybass methods * NO csrf token * weak csrf token * check content type * check referer header * chnage POST to GET or GET to post #### CSRF token bybass methods * reomving ANI-csrf token * NO check for the users token * weak token * Reasuable token * change request method * Guessable token * Bybass referer #### method attacks * remove referer header and send request and check response * remove original header and send request and check response * remove csrf token and send request and check response #### Basic method no defenses * the request ``` POST /myaccount/changeemail HOST: email=.... ``` * the exploit ```html ``` #### CSRF where token validation depends on token being present * the request ```json POST /myaccount/changeemail HOST: email=....&csrftoken=..... ``` * TIPS: reomve the csrf token -THE exploit ```html ``` #### CSRF where token validation depends on request method * the request ```json POST /myaccount/changeemail HOST: email=....&csrftoken=..... ``` * TIPS: reomve the csrf token * Tips: change request TO GET in CSRF payloads -THE exploit ```html ``` #### CSRF where token is not tied to user session * steps\ 1- create two accounts\ 2- go to the first account and change email we will change\ 3- go to second account and try intersept change email then drop request , copy the csrf token\ 4- go to the first account and put csrf token(second account) and try change email is valid or not #### csrf bypass via method override ``` ``` #### CSRF where token is duplicated in cookie ```html

``` #### CSRF where Referer validation depends on header being present ```html ``` #### CSRF with broken Referer validation ```html ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a01-broken-access-control/csrf/csrf-checklist.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.