Cross-Site Request Forgery

Not to be confused with Server-Side Request Forgery

Cross-site request forgery
What is CSRF (Cross-site request forgery)? Tutorial & Examples | Web Security Academy
Session Riding
Cross-site request forgery (also known as CSRF) is a web security vulnerability
It allows an attacker to induce users to perform actions
- They do not intend to perform
It allows an attacker to partly circumvent the same origin policy
- designed to prevent different websites from interfering with each other.

Also known as 1-click attack

SQLMAP - Anti-CSRF Token Bypass

sequenceDiagram
    participant V as Victim (Browser)
    participant LS as Legitimate Website
(e.g., bank.com)
    participant MS as Malicious Website
(e.g., evil.com)

    Note over V, MS: Setup Phase
    V->>LS: 1. Login to legitimate site
    LS-->>V: Authentication successful
    Note right of V: Session cookie stored
in browser
    LS-->>V: Set session cookie

    Note over V, MS: Attack Phase
    V->>MS: 2. Visit malicious website
(via email link, etc.)
    Note right of MS: Malicious page contains
hidden form or script

    MS-->>V: 3. Return malicious HTML page
    Note right of V: Page contains forged request:





    Note over V, MS: Exploitation Phase
    V->>LS: 4. Automatic form submission
POST /transfer
    Note right of V: Browser automatically
includes session cookie
for bank.com domain
    Note over V, LS: Request appears legitimate
due to valid session cookie

    LS->>LS: 5. Process request
    Note right of LS: Server validates session
but doesn't verify origin
    LS-->>V: 6. Transfer completed successfully
    
    Note over V, MS: Attack Successful
    Note right of V: Victim unknowingly
transferred money to attacker

    rect rgb(255, 200, 200)
        Note over V, MS: CSRF Protection Methods:
        Note over V, MS: • CSRF Tokens
        Note over V, MS: • SameSite Cookie Attribute  
        Note over V, MS: • Referer Header Validation
        Note over V, MS: • Double Submit Cookie Pattern
    end