TechKnowSurge
TechKnowSurge Catalog Videos Cross-Site Request Forgery (CSRF)
VideoSecurityFree

Cross-Site Request Forgery (CSRF)

Cross-site request forgery (CSRF) is a trust exploitation attack in which an adversary tricks a legitimate user's browser into sending unauthorized requests to a web server on their behalf. The server processes the request as if it came from the trusted user, granting the attacker the victim's access rights.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Cross-site request forgery (CSRF), cataloged as CWE-352, is a class of web application vulnerability that exploits the trust a server extends to an already-authenticated user. The attack does not require the adversary to compromise the victim's credentials directly. Instead, the attacker crafts a forged request and delivers it in a way that causes the victim's browser to submit it automatically, inheriting the victim's active session and the permissions that come with it. From the server's perspective, the request appears entirely legitimate. A practical illustration of this attack involves a banking scenario. A legitimate account holder has an active, authenticated session with her bank. An attacker constructs a request designed to transfer funds out of her account and delivers it through a medium she interacts with, such as a malicious link or embedded content. Her browser forwards the request to the bank's server along with her valid session credentials, and the server processes the transfer as though she authorized it. The attacker never needs direct access to the account. At a technical level, CSRF abuses the stateless nature of HTTP and the browser's automatic inclusion of session cookies or other authentication tokens with every request to a given origin. The vulnerability exists in the web application's failure to verify that a state-changing request was genuinely initiated by the user rather than forged by a third party. Effective defenses include synchronizer tokens, same-site cookie attributes, and origin header validation, all of which help the server distinguish between requests the user intentionally made and those injected by an attacker.

What you'll learn

What's covered

Cross-Site Request Forgery (CSRF)

Key terms

Cross-Site Request Forgery
CSRF
Cross-Site Request Forgery is a web attack that tricks an authenticated user's browser into submitting unauthorized requests to a web application, exploiting the site's trust in the user's session to perform unintended actions.
Authentication
The process of verifying the identity of a user, device, or system.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Threat Actor
An individual or group responsible for a security incident or attack.

Topics

Csrf Web Security Session Management Attack Techniques Web Applications Cybersecurity

Transcript

One example of a trust exploitation is a cross-site request forgery, or CSRF.

Finding It in the CWE

I'm on the common weakness enumeration site, where we can see all the common weaknesses that are in applications. What I'm going to do is I hit expand all to see all of the weaknesses, and we're going to do a find for CSRF, and then we will find it right here. So this is the cross-site request forgery, and I'm going to open that up. So here is the CWE 352, specifying cross-site request forgery.

What Happens

It gives us a little diagram here. We can open up that diagram, and essentially what's happening is that there's a bank account, and Trudy, who's our adversary here, wants to access this bank account, specifically Alice's account, to be able to steal money from that bank account. Well, there are protections involved here that make it so Trudy can't access this bank account. But what possibly could happen — a cross-site request forgery is going to go cross-site.

So what's going to happen is Trudy is going to submit the request to Alice, which then gets sent to the bank. So it's going through Alice. Well, Alice has already been granted into this bank account — that's her bank account, so she can access it. And by Trudy sending this through Alice, then it gets executed as if Alice sent this request. And the request is to send money from Alice's bank account to Trudy's bank account.

So in this example right here, we have some sort of web services, and we have a client machine, and we have the adversary going through the client machine to gain access to the web server, therefore taking on rights of whatever this client machine has when it accesses this web server. So, cross-site request forgery. Here's the attack card on it. And it really is: the attacker makes a call through the client's machine to access the site on behalf of the client machine.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →