Web Hacking for Pentesters: Cross-Site Request Forgery (CSRF)

Overview

CSRF abuses a victim’s authenticated browser session to trigger state-changing requests the user did not intend. Framework defaults help—but APIs, mobile-web hybrids, and misconfigured cookies still leave gaps.

What You Will Learn

• Identify CSRF-worthy actions

• Review token, Origin, and SameSite controls

• Avoid false positives on safe methods

• Recommend layered mitigations

What to Review

• Password/email changes, transfers, privilege changes, deletions

• Anti-CSRF token presence, binding, and server validation

• Cookie SameSite/Secure attributes and session fixation risks

• JSON endpoints that still accept cookie auth from browsers

Common Mistakes

Token rendered in UI but not verified server-side

Predictable or reusable tokens

Assuming “JSON means CSRF-proof” without additional controls

Method overrides that skip CSRF middleware

Remediation

Use synchronizer tokens for browser-driven state changes.

Validate Origin/Referer strictly where applicable.

Set SameSite cookies thoughtfully; combine with tokens.

For sensitive actions, require re-authentication.

Conclusion

Use these techniques only on systems you are authorized to assess. SapiensHack focuses on practical methodology, clear evidence, and fixes teams can ship.

Related Reading

• Web Hacking for Pentesters: Cross-Site Scripting (XSS)

• API Hacking: OAuth and SAML Security Notes

• Start Here: SapiensHack Learning Path