csrf

CSRF (Cross-Site Request Forgery) — fully explained with bypasses

CSRF: how it's exploited, common defenses (tokens, SameSite, Origin), bypasses (method change, JSON, double-submit, content-type) and where to hunt it in any app.

12 mincsrfauthsession

Cookie flags — Secure, HttpOnly, SameSite and why they matter

HttpOnly blocks XSS-to-cookie, Secure forces HTTPS, SameSite kills CSRF. How they break and what to report when they're missing on sensitive cookies.

8 mincookiessessioncsrf

9 mininformation-disclosurecsrfclient-side-request

IP leak via a chat GIF — Client-Side Request Forgery + Information Disclosure

A social network didn't validate the URL of a GIF sent in chat. Sending a GIF revealed the victim's IP, operating system, phone model and device ID.

Intermediate level

OAuth attacks — state CSRF, redirect_uri bypass, code/token leakage

The missing state parameter, poorly validated redirect_uri, response_type confusion. How to steal OAuth tokens and force account linking.

14 minoauthauthcsrf

15 mincsrfsamesite-bypassjson-csrf

CSRF advanced exploitation — SameSite bypass, JSON CSRF, Flash, file upload CSRF

Advanced CSRF techniques beyond the classic form submit: SameSite=Lax bypass via GET, JSON CSRF with Content-Type tricks, file upload CSRF and exploitation chains.

15 minoauthauthorizationcsrf

OAuth attacks — state CSRF, redirect_uri bypass, token reuse, token IDOR

Vulnerabilities in OAuth 2.0 flows: missing state parameter, redirect_uri loose validation, cross-app token reuse, IDOR in token refresh endpoints.

11 mincorscsrfbrowser-security

CORS misconfigurations — null origin, wildcard credentials and subdomain trust

When ACAO reflects any Origin with ACAC=true, when null is accepted, when subdomains are wildcarded — cross-site leak of authenticated data.

Advanced level

14 minpostmessageiframeorigin-validation

Zero-Click postMessage Origin Bypass — from the canvas to credit drain

The postMessage listener only validated a field of e.data — controlled by the attacker. e.origin was never checked. From an iframe loaded when opening a bot, messages injected as if the victim had written them.