# Cross-Site Request Forgery (CSRF) ## What is it? CSRF, short for Cross-site request forgery, is a type of web security flaw that enables an attacker to trick users into executing actions they didn't intend to do. **A simple example:** * A vulnerable web application has the endpoint `/updateProfile?id={userid}` * When a `POST` request is made to this endpoint the application: * Checks the ID is the current user * If it is, update the profile with the provided information in the request body * When the victim visits the attacker's malicious site, it will: * Send a request to the vulnerable web application * Because the user is logged into that application, the browser will include cookies (importantly, the session cookie) * The vulnerable application processes the request as normal since it came from the user It's important to note that we need some user interaction for CSRF to work. Typically an attacker would place their payload on a site that they control, and try to entice the target with phishing emails, direct messages on social media, etc. Once the user clicks the link and lands on the page, the payload is triggered. CSRF defences are now pretty common, so along with just finding places where users can carry out actions, we also need to be able to bypass defences that have not been properly implemented. **Other learning resources:** * PortSwigger: Web Security Academy * The XSS Rat: Bug Bounty Beginner Methodology: CSRF * Swisskeyrepo: **Writeups:** * ## Checklist * [ ] Does every form have a CSRF token? * [ ] Can we use GET instead of POST (i.e. can our payload be in the URI instead of the body) * [ ] Test the token * [ ] Test without the token * [ ] Test other HTTP methods without the token (e.g. GET) * [ ] Test without the token value (keep the param name, e.g. \&csrf=) * [ ] Test with a random token * [ ] Test a previous token * [ ] Test a token from a different session * [ ] Test with a token of the same length * [ ] Test for predictability * [ ] Test for static values * [ ] Test for known values (e.g. the token is the user-id) * [ ] Is the token tied to a cookie other than the session cookie? * [ ] Can the token be stolen with XSS? * [ ] Is the referer header being used to validate the request origin? * [ ] Do the cookies have SameSite set? (Chrome is lax by default) * [ ] Can we submit the request with GET? * [ ] Can we override HTTP methods with \`X-Http-Method-Override: GET\` * [ ] Can we override HTTP methods with \`\_method=POST\` ## Exploitation ``` ``` ``` Click Me ``` ```

``` ``` document.location = 'https:///employees/add?name='; ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://appsecexplained.gitbook.io/appsecexplained/common-vulns/cross-site-request-forgery-csrf.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.