Web › Module 2 › Lesson 3
CSRF Attacks
Force logged-in victims to submit unwanted requests using their own session cookies
Visual · web_developer
CSRF abuses the browser's habit of attaching cookies automatically. The victim is logged in—you trick their browser into doing the dirty work.
Opening
The browser does what it is told
Cross-Site Request Forgery (CSRF) targets state-changing actions: change email, transfer money, delete account. While you are logged into bank.lab, a tab on evil.lab can submit a form or image request to bank.lab—and your session cookie rides along. The attacker never sees the cookie (Same-Origin Policy blocks reading it), but the request still executes as you.
1. How a CSRF Attack Works
1. Victim logs into a vulnerable site. 2. Victim visits attacker page (or opens malicious email). 3. Attacker page auto-submits POST/GET to the vulnerable site with attacker-chosen parameters. 4. Browser attaches session cookies; server treats it as a legitimate action.
Auto-submit CSRF form (lab education only)<!-- Hosted on attacker.lab — victim must be logged into bank.lab --> <form id="csrf" action="https://bank.lab/transfer" method="POST"> <input type="hidden" name="to" value="attacker"> <input type="hidden" name="amount" value="1000"> </form> <script>document.getElementById("csrf").submit();</script>
<!-- Hosted on attacker.lab — victim must be logged into bank.lab -->
<form id="csrf" action="https://bank.lab/transfer" method="POST">
<input type="hidden" name="to" value="attacker">
<input type="hidden" name="amount" value="1000">
</form>
<script>document.getElementById("csrf").submit();</script>2. GET vs POST CSRF
GET state changes
Dangerous: <img src="https://app.lab/delete?id=5"> fires while browsing.
POST forms
Hidden auto-submit forms or fetch with credentials (where CORS allows).
JSON APIs
Classic form CSRF fails, but cookies + permissive CORS can still bite—design APIs carefully.
3. CSRF vs XSS
XSS runs JavaScript in your origin and can read the page. CSRF only forges requests using cookies the browser sends anyway. XSS often defeats CSRF tokens (script reads the token from the DOM). Fix XSS first; still use CSRF tokens for defense in depth.
Ethical framing
Demonstrate CSRF only against your local DVWA/WebGoat CSRF module or a deliberately vulnerable app you control. Never craft transfer/delete requests against real user accounts.
Knowledge Check
CSRF exploits the fact that browsers:
Multiple choice
Knowledge Check
True or False: CSRF attackers can read the victim's session cookie from JavaScript on evil.com.
True or False
Knowledge Check
CSRF targets are usually:
Multiple choice