{
  "slug": "csrf-cors-testing",
  "title": "CSRF & CORS Misconfiguration",
  "phase": "Exploitation",
  "description": "Test for cross-site request forgery, CORS misconfigurations, and cross-origin data leakage across all state-changing and authenticated endpoints.",
  "difficulty": "medium",
  "tags": [
    "exploitation",
    "csrf",
    "cors",
    "cross-origin",
    "token-validation"
  ],
  "tools": [
    "Burp Suite",
    "curl",
    "nuclei"
  ],
  "steps": [
    {
      "id": "csrf-01",
      "title": "Identify state-changing endpoints",
      "description": "Map all endpoints that perform state-changing operations (password change, email update, fund transfer, settings modification) and note their HTTP method and authentication mechanism.",
      "commands": [
        "cat all-urls.txt | grep -iE '(update|delete|change|transfer|modify|create|add|remove|edit|settings)'",
        "nuclei -l live-hosts.txt -t misconfiguration/ -t vulnerabilities/csrf/ -o csrf-scan.txt"
      ],
      "notes": "Focus on endpoints that use cookie-based authentication — API endpoints using Bearer tokens in the Authorization header are not vulnerable to traditional CSRF."
    },
    {
      "id": "csrf-02",
      "title": "Test CSRF token validation",
      "description": "Test whether CSRF tokens are properly validated by removing the token, submitting an empty token, reusing tokens across sessions, and swapping tokens between users.",
      "commands": [
        "curl -sk -X POST https://target.com/api/change-email -H 'Cookie: session=<session>' -d 'email=attacker@evil.com'",
        "curl -sk -X POST https://target.com/api/change-email -H 'Cookie: session=<session>' -d 'email=attacker@evil.com&csrf_token='"
      ],
      "notes": "Some implementations only check that a token is present but do not validate its value. Test with random strings as well."
    },
    {
      "id": "csrf-03",
      "title": "Test CORS configuration",
      "description": "Send cross-origin requests with various Origin headers to identify reflection, null origin acceptance, wildcard credentials, and subdomain trust issues.",
      "commands": [
        "curl -sk -I https://target.com/api/user -H 'Origin: https://evil.com'",
        "curl -sk -I https://target.com/api/user -H 'Origin: null'",
        "curl -sk -I https://target.com/api/user -H 'Origin: https://sub.target.com'",
        "curl -sk -I https://target.com/api/user -H 'Origin: https://target.com.evil.com'"
      ],
      "notes": "Check both Access-Control-Allow-Origin and Access-Control-Allow-Credentials in responses. Origin reflection with credentials is the most critical finding."
    },
    {
      "id": "csrf-04",
      "title": "Test SameSite cookie attribute",
      "description": "Verify that session cookies use the SameSite attribute and test whether the browser enforces it for cross-site POST and GET requests.",
      "commands": [
        "curl -sk -I https://target.com/login -c - | grep -i 'set-cookie'"
      ],
      "notes": "Cookies without SameSite default to Lax in modern browsers, which blocks cross-site POST but allows top-level GET navigations. SameSite=None requires the Secure flag."
    },
    {
      "id": "csrf-05",
      "title": "Test content-type based CSRF bypass",
      "description": "Attempt to bypass CSRF protection by changing the Content-Type header to text/plain, application/x-www-form-urlencoded, or multipart/form-data, which do not trigger CORS preflight.",
      "commands": [
        "curl -sk -X POST https://target.com/api/update -H 'Content-Type: text/plain' -d '{\"email\":\"attacker@evil.com\"}'",
        "curl -sk -X POST https://target.com/api/update -H 'Content-Type: application/x-www-form-urlencoded' -d 'email=attacker@evil.com'"
      ],
      "notes": "JSON endpoints that do not enforce Content-Type validation can be attacked via HTML forms using enctype=text/plain."
    },
    {
      "id": "csrf-06",
      "title": "Test cross-origin data leakage",
      "description": "Check whether sensitive data is exposed through JSONP endpoints, CORS-enabled APIs, or postMessage handlers without proper origin validation.",
      "commands": [
        "curl -sk 'https://target.com/api/user?callback=leak'",
        "nuclei -u https://target.com -t exposures/apis/ -t misconfiguration/cors/ -o cors-findings.txt"
      ],
      "notes": "JSONP endpoints that return user data are equivalent to a CORS misconfiguration. Also check for postMessage handlers in JavaScript files that do not verify event.origin."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/csrf",
    "https://portswigger.net/web-security/cors",
    "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html",
    "https://owasp.org/www-community/attacks/csrf",
    "https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}