[redlightrouter]

Hi all,

I've found alot of CSRF on populair websites. The only thing is that you need to insert your mail address and current password.
They don't use CSRF tokens, but I don't know if it's still a real vulnerability when this is the case.

Anyone that could help me with this?

Thanks!

[arun hacker]

Hi all,

I've found alot of CSRF on populair websites. The only thing is that you need to insert your mail address and current password.
They don't use CSRF tokens, but I don't know if it's still a real vulnerability when this is the case.

Anyone that could help me with this?

Thanks!

Yes CSRF can be dangerous when it alters the values or settings , deletes the data etc. CSRF has been found is most popular sites like facebook, yahoo, google etc. And i believe still many popular sites are vulnerable to this. This vulnerabilitiy is mostly found in social networking websites and those websites that has the user account functionalities. CSRF can be very dangerous with XSS and it takes a new form vulnerability when combined together as the attacker do not has to trick the victim to visit attacker's site, and anti-csrf token can also be bypassed with the help of xss.

You can read the disclosed vulnerabilities on hackerone and bugcrowd and amongst the disclosed vulns one of the most occuring vulnerability is CSRF.

[redlightrouter]

Awesome guys, thanks. I've found so many popular websites that are vulnerable to csrf, but thought it wasn't a big problem since it's harder to perform a CSRF attack when you don't know the password/email of the victim.