/
web app pentesting
/
cross site request forgery csrf
Menu
Cross-site request forgery (CSRF)
What is CSRF?
How Does CSRF Work?
How to construct a CSRF attack
How to deliver a CSRF exploit
Common defences against CSRF
Bypassing CSRF token validation
What is a CSRF token?
Common flaws in CSRF token validation
Validation of CSRF token depends on request method
Validation of CSRF token depends on token being present
CSRF token is not tied to the user session
CSRF token is tied to a non-session cookie
CSRF token is simply duplicated in a cookie
Bypassing SameSite cookie restrictions
What is a site?
Site VS Origin
How does SameSite work?
Strict
Lax
None
Bypassing Lax restrictions using GET requests
Bypassing SameSite restrictions using on-site gadgets
Bypassing SameSite restrictions via vulnerable sibling domains
Bypassing SameSite Lax restrictions with newly issued cookies
Bypassing Referer-based CSRF defenses
Referer header
Validation of Referer depends on header being present
Validation of Referer can be circumvented
How to prevent CSRF vulnerabilities
