CSRF Attack Tutorial — Cross-Site Request Forgery Explained

CSRF — Cross-Site Request Forgery

CSRF tricks a logged-in user's browser into making unwanted requests to a website where they're authenticated.

How It Works

1. Victim is logged into bank.com
2. Attacker sends email with hidden image: <img src="bank.com/transfer?to=hacker&amount=10000">
3. Browser sends the request WITH the victim's session cookies
4. Bank processes the transfer thinking it's the victim!

Prevention

• CSRF Tokens: Unique token per request that the attacker can't guess
• SameSite Cookies: Browser won't send cookies cross-site
• Re-authentication: Require password for sensitive actions

Practice identifying CSRF in our ethical hacking course.