如何在asp mvc 3中破解回发

我有一些ASP MVC 3下的遗留代码(这绝对打破了所有ASP MVC理论思想)。正如我所低估的那样，这些代码可以通过向控制器发送虚假的回发来破解?我只是想知道如何破解ValidateAntiForgeryToken和Session假会话。人们可以用什么软件来做呢?

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult ProcessSignUpRequest()
{
    string message = "";
    string username = Request.Form["txtusername"];
    string email = Request.Form["txtemail"];
    string name = Request.Form["txtusername"];
    string password = Request.Form["txtoldpassword"];
    string txtCaptcha = Request.Form["txtcaptcha"];
    string startTime = Request.Form["startTime"];
    string userphone = Request.Form["phone"];
    try
    {
        if (txtCaptcha != (string)Session[Constants.CaptchaCodeSessionKey])
        {
            message = "captcha is wrong";
            return GetStandardJsonActionResult(false, message);
        }
        // some code about adding user to database
        return GetStandardJsonActionResult(true, message);
    }
    catch (Exception ex)
    {
        return GetStandardJsonActionResult(false, "Not possible to create user. " + username);
    }
}