ArticleCSRF with broken Referer validation
CSRF with broken Referer validation: This lab's email change functionality is vulnerable to CSRF. It attempts to detect and block cross domain reques…
Blog topic
CSRF research and labs
Cross-site request forgery writeups covering common bypasses, browser behavior, and effective mitigations.
- 14
- Matching posts
Article
ArticleCSRF where Referer validation depends on header being present
CSRF where Referer validation depends on header being present: This lab's email change functionality is vulnerable to CSRF. Although the application…
ArticleCSRF where token is duplicated in cookie
CSRF where token is duplicated in cookie: This lab’s email change functionality is vulnerable to CSRF. It uses the insecure "double submit" CSRF prev…
ArticleCSRF where token is tied to non-session cookie
CSRF where token is tied to non session cookie: This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF at…
ArticleCSRF where token validation depends on request method
CSRF where token validation depends on request method: This lab's email change functionality is vulnerable to CSRF. It attempts to block CSRF attacks…
ArticleCSRF vulnerability with no defenses
CSRF vulnerability with no defenses: This lab's email change functionality is vulnerable to CSRF. • PortSwigger • CSRF • csrf, lab1
ArticleCSRF where token validation depends on token being present
CSRF where token validation depends on token being present: This lab’s email change functionality is vulnerable to CSRF. • PortSwigger • CSRF • lab3,…
ArticleBasic clickjacking with CSRF token protection
Basic clickjacking with CSRF token protection: To solve the lab, craft some HTML that frames the account page and fools the user into deleting their…
ArticleWhat is httpOnly and how does it work?
What is httpOnly and how does it work?: In the Lab 5 on portswigger DOM XSS in jQuery anchor href attribute sink using location.search source. I wasn…
ArticleCSRF where token is duplicated in cookie
CSRF where token is duplicated in cookie: Exploit a double submit cookie CSRF implementation to change a logged in user’s email. The backend accepts…
ArticleCSRF - where token is tied to non-session cookie
CSRF where token is tied to non session cookie: So I did the lab again one day afterwards because I really want to understand what is going. • Securi…
ArticleCSRF - where token is not tied to user session
CSRF where token is not tied to user session: This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF atta…
ArticleCSRF where token validation depends on token being present
CSRF where token validation depends on token being present: To solve the lab, use your exploit server to host an HTML page that uses a CSRF attack to…
ArticleHack The Box Explore user-flag
Hack The Box Explore user flag: Capture at least one user flag per day. This entry documents a box where initial scans missed the path to user, follo…