Busting CSRF: The Hidden Dangers of JSON Exploited

This write-up is about an interesting technique not known to many people, which I used to bypass CSRF protection on every single endpoint of a website that belonged to a private bug bounty program.

Let’s jump right in…

I was exploring the website when I stumbled upon an endpoint for inviting admins. It looked like this:

POST /api/rounds/test_round/admin/invite
Host: example.com
Cookies: ……
Content-type: application/json
{
 "email": "admin@gmail.com"
}

At first glance, it seemed safe from CSRF attacks. You can’t send …

bug bounty cybersecurity web security