logo

Cross-Site Request Forgery (CSRF)

Category:

Web Application

Summary:

How CSRF tricks a logged-in victim's browser into sending unwanted state-changing requests, and how anti-CSRF tokens and SameSite cookies stop it.

Cross-site request forgery (CSRF) happens when an attacker-controlled page causes the victim’s authenticated browser to fire a state-changing request the user never intended — changing an email address, transferring funds, granting access. The app trusts the ambient session cookie and can’t tell the request wasn’t deliberate. CSRF is often amplified by XSS, which can read and replay anti-CSRF tokens directly, and it’s commonly paired with IDOR to target a specific victim’s object.

Common Techniques

  • Auto-submitting form POST — a hidden form on the attacker’s page submits itself on page load.
  • Image / GET side-effects — a state-changing action wired to a GET request fires from a simple <img> tag.
  • JSON / CORS misconfiguration — permissive CORS lets a cross-origin script read responses it shouldn’t.
  • Login CSRF — forcing the victim into the attacker’s session instead of stealing the victim’s.
  • Token-absence vs. token-not-validated — a token exists in the form but the server never actually checks it.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Testing

Build a minimal cross-origin page with an auto-submitting form aimed at a state-changing endpoint, and load it while authenticated as a test user:

<form action="https://target/account/email" method="POST" id="f">
  <input name="email" value="attacker@evil.example">
</form>
<script>document.getElementById('f').submit()</script>

If the request succeeds without a valid per-request token — or without a SameSite cookie block — the endpoint is exploitable. Record the endpoint, the missing control, and the proof in the pentest report so it’s reproducible for the dev team.

Remediation

Require a per-request anti-CSRF token validated server-side on every state-changing call, and set session cookies to SameSite=Lax or Strict so browsers won’t attach them to cross-site requests. Add re-authentication for sensitive actions (password change, payout), and never let a GET request change state.