CSRF labs
Cross-Site Request Forgery (CSRF)
What is CSRF?
CSRF forces an authenticated user to perform unwanted actions on a web application where they're logged in. It can change passwords, transfer funds or modify settings without the user's consent.
Why practice CSRF?
Although many modern frameworks include CSRF protection, incorrect implementations are common. CSRF bugs on critical operations (email change, transfers, permissions) tend to pay high bounties because of their direct impact and because they enable account takeover chains.
What will you learn with the CSRF labs?
You'll learn to detect missing or reused tokens, SameSite=Lax bypass techniques (subdomains, top-level navigation), CSRF on JSON endpoints with permissive Content-Type, HTTP method fixation, and how to chain CSRF with XSS for full compromise.
Types of CSRF we cover
- Token missing/reusable
The sensitive endpoint doesn't require a token, or accepts any valid token from the same user. The easiest to exploit.
- SameSite bypass
Lax allows top-level GET. If the sensitive endpoint accepts GET (email change via link), it's a direct bypass.
- JSON CSRF
Endpoints that accept `Content-Type: text/plain` can receive a cross-origin POST with JSON in the body.
- Method override
Apps that allow `_method=PUT` in POST forms can be CSRF'd for idempotent actions.
How do you find and exploit CSRF?
A practical playbook — from recon to proof of concept.
- 1
Locate a sensitive action
Email change, password change, transfer or role change. Capture the request and check whether it carries an anti-CSRF token.
POST /account/email body: email=victim@target.com - 2
Try dropping/reusing the token
Remove the CSRF parameter or reuse one from another session. If the server still accepts the request, it's vulnerable.
POST /account/email (no csrf_token) → 200 OK = vulnerable - 3
Build the auto-submit PoC
An HTML page that submits the form on load. When the victim visits it while authenticated, the action executes.
<form action="https://target/account/email" method=POST><input name=email value=atk@evil.com></form><script>document.forms[0].submit()</script> - 4
Bypass SameSite=Lax
Lax still allows top-level navigation with GET. If the action accepts GET, a simple link/redirect triggers the CSRF.
<img src="https://target/account/email?email=atk@evil.com"> (if it accepts GET) - 5
CSRF on JSON endpoints
If the endpoint accepts text/plain, send the cross-origin JSON with a normal form or fetch without preflight.
fetch('https://target/api/email',{method:'POST',credentials:'include',headers:{'Content-Type':'text/plain'},body:'{"email":"atk@evil.com"}'})
Learn the theory
Academy: Authentication & Sessions
Loading labs...
View in full catalog →Frequently asked questions
What is CSRF?
Cross-Site Request Forgery is an attack that tricks an authenticated victim's browser into sending an unwanted request (change email, password, transfer money) by exploiting the fact that session cookies are sent automatically.
How is a CSRF exploited?
You create a malicious page with a form or request pointing at the target's sensitive action. When the victim, with an active session, visits the page, the browser sends the request with their cookies and the action runs on their behalf.
How do you find CSRF in bug bounty?
Capture state-changing actions and check whether they carry an anti-CSRF token, whether that token is validated, and whether it can be removed or reused. Also check whether the action accepts GET or permissive Content-Types (text/plain) that make cross-origin easier.
How do you prevent CSRF?
Use anti-CSRF tokens per session and per request, mark cookies as SameSite=Strict or Lax, verify Origin/Referer headers on sensitive actions, and require re-authentication for critical operations.
Difference between CSRF and XSS?
XSS runs the attacker's code in the victim's browser (it can read data and the response). CSRF runs no code and reads no responses: it only forces the victim to send a blind request. An XSS breaks any CSRF defense because it runs inside the origin itself.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice CSRF in real labs
Every CSRF lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime