New to this? Try a free practice lab — a scripted hacking challenge in your browser, no account needed.
What you'll do
Cross Site Request Forgery (CSRF) is when an attacker can induce a victim to make a request to a site they are already authenticated to and cause them to make changes that they otherwise wouldn't want to do.
For example, an attacker could cause the victim to change their password or their contact email without their knowledge.
The best modern defence against CSRF is the anti-CSRF token, a random token generated per session that must be submitted with each request in order to ensure that the legitimate client is the source of the request.
Since the attacker has no way of knowing this token, the attacker cannot cause the victim to submit it along with the change request.
However, there is at least one case where that isn't true.
That is, is the CSRF protected site also has a Cross Site Scripting vulnerability on a page that contains the token.
An attacker may be able to leverage the XSS to leak the CSRF token, at which point the CSRF attack can be carried out.
