# CSRF Client side request forgery allows an attacker to induce users to perform actions that they do not intend to perform. ## Deliver a CSRF Exploit ### **Reflected XSS** Attacker will place the malicious HTML onto a web site that they control. ### GET method #### **Example:** ```html

``` ## Common CSRF vulnerabilities * Some applications correctly validate the token when the request uses the POST method but skip the validation when the GET method is used. * Some applications correctly validate the token when it is present but skip the validation if the token is omitted. * Some applications do not validate that the token belongs to the same session as the user who is making the request. * Some applications do tie the CSRF token to a cookie, but not to the same cookie that is used to track sessions. #### **Example:** ```html

``` * Some applications do not maintain any server-side record of tokens that have been issued. * Cookie **SomeSite=Lax** bypass via method override. * Change **POST** method to **Get** with **"\_method"** parameter. #### Example: `/change-email?email=attacker@attack.net&_method=POST` ## Defenses * [x] CSRF tokens. * [x] HTTP cookie header (CSRF-key). * [x] Captcha. * [x] HTTP Referrer header. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://smadi0x86-blog.gitbook.io/smadi0x86-playground/offensive-security/web-attacks/client-side/csrf.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.