Using Cross-Site Scripting to bypass CSRF protection and CORS restrictions

Oftentimes, when we, as penetration testers, describe XSS to our clients or to developers, we focus on the defacement and phishing/information theft aspects of its impact and overlook the fact that it can be used by the attacker to forge requests using the victim's session to perform any action available to the victim within the application.

In this recipe, we will illustrate this situation using an XSS attack to forge a request that is protected with an anti-CSRF token.

How to do it...

For this recipe, we will use the bWApp application in bee-box, http://192.168.56.13/bWapp in this example, and we will set the security level to Medium.

1. Once logged in to bWApp, go to the bug Cross Site Request Forgery (Transfer Amount).
2. Enter an account number and amount and click on the Transfer button.
3. Let's analyze the following request in Burp Suite. All of the parameters are sent via a GET request; by looking at the token parameter...