Performing CSRF Exploits Over GraphQL

[@mnageh-bo1mm]

what? most endpoints I came across were using content type json triggering a preflight request which killed any attempt of csrf

[@intigriti]

It's probably uncommon, Portswigger stated:
"POST requests that use a content type of application/json are secure against forgery as long as the content type is validated. However, alternative methods such as GET, or any request that has a content type of x-www-form-urlencoded"
Worth a try! 🙏

[@mnageh-bo1mm]

@@intigriti thx ... Looks like it's validated too.

[@jaywandery9269]

My generated CSRF POC is not auto submitting the form. I have to press the submit button for the exploit to work, hence the lab won't solve.

[@intigriti]

Does it look like the PoC used in the video?

[@LearnTv-qy5xb]

Nice

[@LearnTv-qy5xb]

Very nice

[@intigriti]

Thanks! 💜

[@mnageh-bo1mm]

Nice video tho

[@intigriti]

Appreciate it 💜