CSRF Hunting
State-changing requests that run as the victim from a foreign origin. JSON and SameSite made this rarer, not dead.
Tags: csrf, samesite, ato
Level: intermediate
Method
Find state changes
Email change, password change, OAuth linking, transfer, delete, MFA disable. GET that changes state is still common.
Tools: Burp Suite
Token checks
Missing token, token in cookie only (double-submit broken), token not tied to session, token in GET.
Content-Type
text/plain and application/x-www-form-urlencoded from a form still work when application/json does not (no preflight).
SameSite and subdomain
SameSite=None, or a sibling XSS, or a scheme downgrade. Cookie Domain=.target.com plus a takeover is CSRF with extra steps.
Field notes
- Login CSRF and logout CSRF are usually P5. Email-change CSRF is ATO.
- Flash is dead. Do not copy 2016 PoCs.