The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If the application uses Ajax, look for any instances where a response

contains sensitive data in JSON format or other JavaScript.

■

As with standard XSRF, determine whether it is possible to construct a

cross-domain request to retrieve the data. If the request does not contain

any unpredictable parameters, then the application may be vulnerable.

■

JSON hijacking attacks can only be performed using the 

GET

method,

because this is the method used when a URL specified in a