• CSRF Normal
• Change Method To GET-Based
• Change Value Of CSRF-Token To undefined
• Delete CSRF Token Value Or Delete Token Parameter
• Use The same CSRF Value In Different Accounts
• Replace Value CSRF Token with Same Length Characters
• Change Content-Type from application/json to text/plain
• Use Vulnerable-Subdomain To Bypass CSRF Token

1. Standard CSRF test – remove token entirely
2. Change method to GET
3. Change CSRF token value to undefined
4. Delete token value or entire parameter
5. Use same CSRF token across two different accounts
6. Replace token with same-length random string
7. Change content-type from application/json to text/plain
8. Use a vulnerable subdomain to bypass CSRF token validation

Blank referer bypass: <meta name=“referrer” content=“no-referrer” />

iframe data URI bypass: <iframe src=“data:text/html;base64,FORM”>

• Full Zseano CSRF Guide