> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.
# CSRF (Cross-Site Request Forgery)
> Exploiting Cross-Site Request Forgery vulnerabilities, bypassing CSRF protections including tokens, SameSite cookies, and Referer checks, with ready-to-use PoC templates.
Cross-Site Request Forgery (CSRF) exploits a web application's trust in an authenticated user's browser. An attacker tricks a victim into sending a forged request using their active session.
## Prerequisites for a CSRF Attack
1. **A valuable action** — password change, email change, privilege escalation
2. **Cookie-only session management** — session maintained via cookies or HTTP Basic Auth
3. **No unpredictable parameters** — no unique tokens required
## Defenses and Their Pitfalls
| Defense | Pitfall |
| -------------- | ------------------------------------------------------------------ |
| CSRF tokens | Only validated when present; empty token may be accepted |
| SameSite=Lax | Still allows top-level cross-site navigations (form GETs) |
| Referer check | Bypass with `meta name="referrer" content="never"` or regex tricks |
| Custom headers | X-Requested-With can sometimes be spoofed |
## Token Bypass Techniques
### Missing Token Validation
```http theme={null}
# Remove the CSRF parameter entirely or send empty value
POST /admin/users/role HTTP/2
Content-Type: application/x-www-form-urlencoded
username=guest&role=admin&csrf=
```
```html theme={null}
```
### Token Not Tied to User Session
If tokens are validated against a global pool:
1. Authenticate with your own account
2. Obtain a valid token from the pool
3. Use that token in a CSRF attack against another victim
### POST to GET Method Bypass
Some applications only validate CSRF on POST:
```http theme={null}
# Original POST (with token)
POST /index.php?module=Home&action=HomeAjax&file=HomeWidgetBlockList HTTP/1.1
__csrf_token=sid:...&widgetInfoList=[{"widgetId":"..."}]
# Bypass as GET (no token needed)
GET /index.php?module=Home&action=HomeAjax&file=HomeWidgetBlockList&widgetInfoList=[{...}] HTTP/1.1
```
### Method Override
```http theme={null}
# Use _method parameter to override HTTP method
POST /users/delete HTTP/1.1
Content-Type: application/x-www-form-urlencoded
username=admin&_method=DELETE
```
Override headers: `X-HTTP-Method`, `X-HTTP-Method-Override`, `X-Method-Override`
### CSRF Token via Cookie (Double Submit)
If the token is in both cookie and request body, exploit CRLF injection to set the cookie:
```html theme={null}
```
### Referrer Bypass
```html theme={null}
```
## PoC Templates
```html theme={null}
```
```html theme={null}
```
```html theme={null}
```
```html theme={null}
```
## Stored CSRF via HTML Injection
```html theme={null}
```
## Login CSRF + Stored XSS Chain
Force the victim to log into an attacker-controlled account, then navigate to a page with stored XSS:
```html theme={null}
```
## Exfiltrating CSRF Tokens
If a CSRF token is in use, exfiltrate it via:
* **XSS** — make the victim's browser read and send the token
* **Dangling Markup** — steal tokens from page attributes using `