Additional CSRF Checks
Summary: PortSwigger's BApp Store lists EasyCSRF, a Burp Suite extension by Mikhail Egorov (version 2.1, last updated 14 December 2018) that helps find weak CSRF protection bypassable through content type, referrer, or obscure data formats such as binary. The extension is not a scanner: it automatically modifies POST, PUT, DELETE and PATCH requests and highlights them in Proxy HTTP history, leaving the tester to judge from the application's UI which modified requests succeeded, and it is disabled by default because its modifications are aggressive.
Why it matters: The extension targets CSRF defenses built on content type or obscure formats for REST and GraphQL APIs, and it ships disabled by default because its request modifications are aggressive - a reminder that protections assumed sound at the API layer are exactly where bypass testing starts.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026