Web Security
CSRF — Cross-Site Request Forgery
Trick a logged-in user's browser into making a request to another site without them knowing. The browser sends the session cookie automatically — and the server thinks it's a real request.
Intermediate45 min8 lessons2 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Understand why cross-origin requests are dangerous without CSRF tokens
- ✓Build a CSRF PoC that performs state-changing actions as a victim
- ✓Bypass SameSite=Lax, referer checks, and weak token validation
- ✓Chain CSRF with stored XSS for no-click exploitation