CSRF Menu

4 labs

Cross-Site Request Forgery

Any state-changing action can carry CSRF; only the crucial ones are worth reporting. Find the action, read its request, host the POC, validate cross-account.

CSRF: unprotected GET actionReady
CSRF: POST action (email)Ready
CSRF: token removal bypassReady
CSRF: chaining self-XSSReady

⚠️ Training site — labs are deliberately vulnerable. Follow the method panels inside each lab.

← All lab sets