CSRF Explained Like You’re Five

CSRF sounds scary but the idea is genuinely simple once you get it. Let me explain it like you're five (no offense 😄).

The Core Idea

CSRF = Cross-Site Request Forgery. It means tricking YOUR browser into doing something on a website you're logged into — without you meaning to.

Here's the kid version: imagine your browser is a loyal dog that does whatever its owner (a website) says. CSRF is a stranger throwing a ball and the dog fetching it — because the dog can't tell the command came from the wrong person. 🐶

A Real Example

Say your bank has a "transfer money" feature. When you click it, your browser sends a request — and because you're logged in, your browser automatically attaches your login cookies. The bank sees the cookies and goes "yep, that's Nitin, do the transfer."

Now an attacker makes a sneaky webpage with a hidden form that fires that SAME transfer request. You visit their page (thinking it's a funny cat video). Your browser sends the transfer request WITH your cookies attached. The bank does it. Money gone. 😳

The attacker never saw your password. They just borrowed your logged-in browser.

What Makes A Site Vulnerable

A site is vulnerable to CSRF when it relies ONLY on cookies to verify a request, and has no extra protection. The fix is usually a "CSRF token" — a secret value that only the real site knows. No token check = CSRF possible.

How To Hunt It

1. Find a state-changing action (change email, change password, transfer, delete)
2. Capture the request in Burp
3. Look: is there a CSRF token? A random secret value in the request?
4. If NO token → try removing/changing it and replaying. Does the action still work?
5. If it works without proper verification → likely CSRF ✅
6. Build a simple proof-of-concept HTML page that fires the request to prove it

The Juiciest Target

Go for actions that matter: changing the account email or password. Why? Because a CSRF that changes someone's email can lead to a FULL account takeover (change email → reset password → own the account). That escalation turns a "medium" into a "critical."

My Honest Tip

Don't just check IF there's a token — check if it's actually VALIDATED. I've seen sites with CSRF tokens that… don't get checked at all. Remove the token, send the request, and it still works. The defense was decorative. Always test whether the protection is real, not just present.

Next post: file upload bugs — turning a harmless image upload into something much more powerful.

Stay sharp! 🐶