Episode 28: Surfin' with CSRFs
Critical Thinking - Bug Bounty Podcast
00:00
How to Find Vulnerabilities in an Application
One of the main ways that I find C-Surf nowadays is servers that are using just plain JSON requests and, you know, as we know,JSON as a content type is not vulnerable to cross-site request forgery. However, if you change the content type from text plain or for to X, W, W form URL encoded, then it may be vulnerable. So those are good areas to check. It normally only takes one or two different checks because I guess maybe this is my experience. But in his experience, he doesn't check every single endpoint for this.
Play episode from 53:59
Transcript
