Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is a client-side technique used to attack other users of a web application. Using CSRF, attackers can send HTTP requests that pretend to come from the victim, carrying out unwanted actions on a victim's behalf. For example, an attacker could change your password or transfer money from your bank account without your permission.
Hunting for CSRF
- Spot the state-changing actions on the application and keep a note on their locations and functionality.
- Check these functionalities for CSRF protection. If you can't spot any protections, you might have found a vulnerability.
- If any CSRF protection mechanisms are present, try to bypass the protection by using the protection-bybass techniques (see book for reference).
- Confirm the vulnerability by crafting a malicious HTML page and visiting that page to see if the action has executed.
- Think of strategies for delivering your payload to end users.