Bug Bounty Hunting: Web Vulnerability (Cross-Site Request Forgery)
1 min read
Summary
Cross-Site Request Forgery (CSRF) involves tricking a victim into submitting a request to perform an action on a web service where they’re authenticated.
CSRF attacks target state-changing requests, such as changing passwords, making payments, or posting on social media.
Protection measures against CSRF attacks include implementing CSRF tokens, enforcing same-site request policies, and validating referrer headers.
Websites commonly use CSRF tokens, which are unique, random tokens added to forms and validated on submission to verify the request’s legitimacy.
In this article, we discussed various methods to bypass CSRF protections that may be poorly implemented, including exploit clickjacking, changing the request method, bypassing CSRF tokens, double-submit CSRF cookies, and referer header checks.
We also covered various examples of how these bypasses are implemented in practice using fetch API, img tags and more.
Lastly, we looked at a few real-world examples of CSRF vulnerabilities and their potential impacts.
Be sure to implement proper security practices to ensure CSRF protections for vulnerable endpoints.