Bug Bounty Hunting Essentials

Detecting and exploiting CSRF

To detect CSRF flaws in an application, it is important to navigate through the entire application, trying to map all the called methods to identify which are important due to the kind of processing it has. We can also do this to find out how they are called, which parameters are sent to the application, if there is any anti-CSRF protection, and if it is one of the vulnerable protections we saw before. Also, if you detect that the protection is currently implemented, try to find an error. Maybe the information you need to exploit the vulnerability is in another application's request.

You can use the Site map tab in Burp Suite, or in another proxy, to detect when a resource is called to other domains:

Also look ...