Update Cross Site Request Forgery(CSRF) Bypass.md

CSRF/Cross Site Request Forgery(CSRF) Bypass.md

@@ -21,5 +21,19 @@ I Hope This Will Help You.
 
 -Switch From Non-Form `Content-Type: application/json` or `Content-Type: application/x-url-encoded` To `Content-Type: form-multipart`
 
+-Bypass the regex
+  If the site is looking for “bank.com” in the referer URL, maybe “bank.com.attacker.com” or “attacker.com/bank.com” will work.
+    
+-Remove the referer header (add this <meta name=”referrer” content=”no-referrer”> in your payload or html code)
+
+-Clickjacking
+
+  (If you aren’t familiar with clickjacking attacks, more information can be found https://owasp.org/www-community/attacks/Clickjacking.)
+  Exploiting clickjacking on the same endpoint bypasses all CSRF protection. Because technically, the request is indeed originating from the legitimate site. If the page where   the vulnerable endpoint is located on is vulnerable to clickjacking, all CSRF protection will be rendered irrelevant and you will be able to achieve the same results as a CSRF   attack on the endpoint, albeit with a bit more effort.
+	
+
+
 ```
-Author: [@SMHTahsin33](https://twitter.com/SMHTahsin33)
+# Authors
+* [@SMHTahsin33](https://twitter.com/SMHTahsin33)
+* [@Virdoex_hunter](https://twitter.com/Virdoex_hunter)