GIAC
GWAPT · Question #30
A web application you are testing uses anti-CSRF tokens but allows GET requests for sensitive operations. How would you verify if it is still vulnerable to CSRF?
The correct answer is B. Embed a malicious request in an image tag and load it in the browser. See the full explanation below for the reasoning.
Question
A web application you are testing uses anti-CSRF tokens but allows GET requests for sensitive operations. How would you verify if it is still vulnerable to CSRF?
Options
- AAttempt to change user data using a POST request
- BEmbed a malicious request in an image tag and load it in the browser
- CDisable JavaScript in the browser and navigate the application
- DReboot the server to reset sessions
How the community answered
(40 responses)- A18% (7)
- B73% (29)
- C8% (3)
- D3% (1)
Community Discussion
No community discussion yet for this question.