Web Hacking for Pentesters: Cross-Site Request Forgery (CSRF)

CSRF is the browser doing something authenticated because you tricked the user's session into it. Less trendy than XSS, still relevant on state-changing endpoints without tokens.

Modern SameSite cookies helped; they didn't delete the class.

CSRF reviews age well—frameworks change, but state-changing POSTs without unpredictable tokens keep appearing in corners nobody migrated. Email unsubscribe and legacy admin forms are perennial culprits.

Where to look

Password/email changes, MFA toggles, billing actions, and JSON endpoints that ignore Content-Type checks. Mobile apps sometimes skip CSRF assumptions wrongly on cookie-less APIs—verify.

Testing without theater

On authorized apps, verify whether sensitive actions require unpredictable tokens, correct Origin/Referer validation, or re-auth.

• Test cross-origin form posts and fetch patterns

• Note exceptions for 'API-only' routes

• Document impact: account takeover vs minor prefs

Fixes

Synchronizer tokens, double-submit cookies where appropriate, SameSite=Lax/Strict, and requiring password for destructive actions.

CSRF proofs should use test accounts you control.

Don't host PoC pages that target real users outside scope.

Retest CSRF fixes by replaying old requests after deploy—teams often add tokens to forms but forget JSON APIs used by the mobile app.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Remember logout CSRF—sessions linger awkwardly when users can't sign out safely.

Content-Type quirks

JSON endpoints with weak CSRF protections sometimes accept simple form posts—document content-type handling clearly.

API keys in headers aren't CSRF-proof if browsers can trigger cross-origin requests with credentialed cookies elsewhere.

Modern SPA notes

SPAs using cookie auth still need CSRF on state-changing JSON if cookies ride along.

Double-check logout and password flows—classic CSRF survives redesigns.

Recommend SameSite cookies plus tokens for high-impact actions together—not either/or lazily.

---

Worth reading next

Clickjacking: UI Redressing Risks and Defenses

Web Hacking for Pentesters: Cross-Site Scripting (XSS)

Penetration Testing: Web Application Checklist (WAPT)