Web Application Hacking (Hands-On)

Cross-Site Request Forgery (CSRF)

Force a logged-in victim's browser to perform actions they didn't intend.

Intermediate · 12 min

Open the interactive lesson →

CSRF abuses the fact that browsers automatically attach cookies to requests. If a state-changing action (change email, transfer funds) relies only on the session cookie, an attacker can craft a page that silently submits that request from the victim's authenticated browser.

<!-- Victim just needs to visit the attacker's page while logged in -->
<form action="https://bank.com/transfer" method="POST" id="f">
  <input name="to" value="attacker">
  <input name="amount" value="5000">
</form>
<script>document.getElementById('f').submit()</script>

Requirements for CSRF

• A state-changing request (not just reading data).
• The app relies on automatic credentials (session cookies) alone.
• No unpredictable token the attacker can't guess.

Take the quiz →