Cross-Site Request Forgery (CSRF) | Complete Guide

In this video, we cover the theory behind Cross-Site Request Forgery (CSRF) vulnerabilities, how to find these types of vulnerabilities from both a white box and black box perspective, how to exploit them and how to prevent them.
▬ 🌟 Video Sponsor 🌟 ▬▬▬▬▬▬▬▬▬▬
Sign up to Intigriti: go.intigriti.com/ranakhalil (affiliate link)
▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: academy.ranakhalil.com/p/web-...
▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬
00:00 - Introduction
00:29 - Intigriti sponsorship (go.intigriti.com/ranakhalil)
01:24 - Agenda
02:12 - What is a CSRF vulnerability?
19:14 - How to find CSRF vulnerabilities?
26:07 - How to exploit CSRF vulnerabilities?
32:50 - How to prevent CSRF vulnerabilities?
47:15 - Resources
47:57 - Thank You
▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
Video slides: github.com/rkhal101/Web-Secur...
Web Security Academy: portswigger.net/web-security/...
OWASP - CSRF: owasp.org/www-community/attac...
OWASP - CSRF Prevention Cheat Sheet: cheatsheetseries.owasp.org/ch...
Rana's Twitter account: / rana__khalil
Hacker Icon made by Freepik: www.freepik.com

[@RanaKhalil101]

Interested in supporting me and gaining early access to the Web Security Academy videos when they're recorded? Consider buying my course: academy.ranakhalil.com/p/web-security-academy-video-series! ✨ ✨

[@MP-eq8fx]

Cant praise enough. May be its my shortcoming, but many paid courses couldnt explain me concepts which your videos did in a very simple way. I am learning now, and if I ever get a bounty, first thing will be to support you.

[@RanaKhalil101]

​@@MP-eq8fx No need to purchase my course. Glad you're liking the series!

[@MP-eq8fx]

@@RanaKhalil101 request you to do one video on how to use Burp Suite.

[@macbook6507]

Thanks for the lecture, teach us about CSS full course

[@saneyalam7434]

Bought the course to support you. Hoping for more content soon

[@robot67799]

Your teaching style is the best. Really difficult to find teachers like you 😭. I'm having difficulties in XSS. Hope you will make videos on that too ❤️❤️

[@devinosborne3396]

7:55 and this is the best explanation i've heard yet. Well done. Very clear

[@saneyalam7434]

Great explanation. All my confusion related to CSRF are gone now... Thank you so much for creating such content.

[@govind22703]

For some reason, I really like listening u explain stuff. This reminds me of the science tv shows I used to watched as a kid :)

[@swamimzaman7058]

I like the way you explain the topics very minutely you explain it’s very easy to understand .Hoping you to upload all the labs of portswigger soon.

[@gangsternerd8419]

Thanks for everything you do and you are highly appreciated, we could appreciate an updated version of this video or maybe just a part that include exploring json request type csrf tricks and tips, including some guideline that could help beginners, I could appreciate especially covering using flash to exploit csrf ❤

[@rajanrawal6396]

i don't even know how to put things into words the way how you explain, it's an amazing mam..we need such playlist more in the future..

[@abidkhan9934]

Hey rana Khalil good to see u.. please do other topics as soon as possible.. because u have an outstanding ability to train.

[@rishabhsahni4312]

Very well explained , covering each aspect in detail . Highly Appreciated!! Rana 👍

[@salimzavedkarim230]

This is gotta be the best video on the Internet. I'm a fan now.

[@t41h45]

Awesome tutorial ever. First complete SQLi and now CSRF 👍😎

[@DaggerSecurity]

السلام عليكم ما شاء الله هذا أحسن شرح في الموضوع جزاك الله خيرا

[@Hefnawiat]

Excellent quality, amazing content, and very clear way in illustration, I am amazed, greetings from Egypt

[@thesecuritypoint]

Ohh mam, after so long time. Waiting the new topic after being master in sql😁

[@xa3da4]

Awesome Explanation 🙌💥✌✌Thanks ma'am ! (Finally Landed on the BEST CSRF EXPLANATION TUTORIAL on KZbin) This channel Deserves Millions of Subscribers ...after somedays this playlists will also hit millions.🔥

[@javhaasuhochir8126]

incredibly clear and easy to understand, thank you

[@gameforme6007]

just finished watching the full video .. really awesome content.. Thanks for that.

[@sawtintkyaw887]

Hello Rana Khalil I check your channel every week for new learning video. Thank you again.

[@bird271828]

Rana, I love your videos and your explanations. They are very informative. Thank you.

[@w3w3w3]

best video ever on the subject! you have a great way at explaining things lol. thanks

[@yevhendidenko3833]

God, how wanderful and detailed you can explain! Thaaaanks!!

[@amolgangurde2790]

Awesome video and detail explanation. Thank you 👍

[@petergentile8974]

these series are amazing!, thank you.

[@abdallahezat8604]

That is really awesome session,Thanks alot Rana and great effort.

[@masicre9574]

Thank you soo much for this video...I am a fresher to this field...This class was awesome...please upload more videos and labs on attacks...

[@rmzhmd1057]

Oh, my God, how well you explain this

[@bertrandfossung1216]

Rana thank you very much. CSRF is my best bug class..

[@user-wl1ry9ot5u]

this video helped me as helll I got all my doubts clear TNX

[@alimahmouditavana3719]

i'm so excited,please upload this video

[@phinehasantwi9615]

Thanks so much for given us the lessons of CSRF

[@jub0bs]

44:45 "Of course, you need to use [SameSite] in addition to CSRF tokens and not as a defence on its own." This cannot be repeated enough 👏👏👏

[@gameforme6007]

just complete watching the full video . Really awesome content. Thanks for the content apu(sister)

[@zubairsafiii]

love from pakistan Thanks for doing such amazing job. people get's to learn alot.

[@Mohd-0_0-Taiyyab]

This video needs 100 million views

[@sto2779]

Excellent explanation on the topic. Thanks.

[@fishslider]

Best in depth video I found

[@acronproject]

Thank you Ms.Khalil is very useful for me.

[@mohamed__sharif]

This is a great video. Thank you.

[@electrowizard2658]

im from india mam u are a very good teacher i wish i could have u as my cybersecurity mentor

[@JacobSean-iy3tl]

you have such a calming voice

[@paulojr1384]

Im in XSS by The PortSwigger learning Path. Ansious to cath The next chapter CSRF to whatch The Best Teacher. Tnx👍

[@allmusic1281]

rana I love your videos and the way you explain everything, is it possible that you can activate the subtitles in this video? my English is not very good, but with the subtitles I can understand your video perfectly, I hope it is possible and thank you very much for sharing your knowledge, it is of great value.

[@HakanGalip]

Thanks a lot clear to understand

[@akahumpty]

Great video!

[@fabiosalvi9035]

Thank you. Your video is really well done :-)

[@OneMinExplains]

Thanks Maam 🧑🏻‍💻😃

[@Mersal-tq9lm]

Really it was great 👍

[@ghassenbarkache1676]

I’ve been following you for a while thank you for what you are doing; I watched laltely your interview with David Bombal on his youtube channel; I’m really impressed and I would like to thank you for your advices. I have some questions regarding intigriti if you can reply to them I would be grateful

[@mdparvejhasan7040]

awesome work 👍😀

[@aqibmunshi6184]

Great video Rana. A quick question..why doesnt the browser attach the csrf token just as it attaches the cookie when the attacker sends a url of the site with email change parameter?. I mean how does the browser decide when to attach the csrf token and when not? I mean if an attacker sends me a link for email change and I have a cookie and token in the browser, why wont the browser not attach the csrf token at that point in time?

[@forceboxed]

For stateless applications, shouldn't a single CSRF token (passed as hidden input field) be enough? Why do we need double submit defence?

[@baybars4392]

Hi Rana Khalil, my English knowledge is not very good, but if I ask that your videos are very instructive, can you add Turkish and English subtitle options to your video?

[@nikhilbk3409]

Second question is Under Inadequate defense, instead of using the referrer header, if Origin header is used against Whitelist allowed origin, will it become another layer of security for CSRF attack OR is Origin header also can be spoofed?

[@laxmantamong2364]

but how does the attacker know that the link has been clicked and email got changed?

[@Hussain-we6tk]

Hi, I have a doubt as why Post Method will not include cookies?

[@waliulahmed9582]

Great!!

[@salahalgarhy3334]

Why is the subtitles closed on the video? Please look into this matter

[@gnomoleproso47]

best video ever

[@rahmanasadur8167]

Excellent

[@sureshiva4605]

Hey Nicely done

[@psychology2251]

keeeeeeeep going want wait to finishing all labs with you ^_^

[@saikiran-ez6ud]

I great one I ever thanks 🥂

[@nikhilbk3409]

hello ma'am, I have doubt when the attacker send the email to victim with malicious link to click. In this case as you told in the Additional defense concept regarding SameSite attribute, since the victim clicked the link in the gmail, so if the SameSite=Strict then should CSRF attack will fail? because the request is initiated from the third part gmail. Is my undestanding is wrong?

[@kiiwwwiiii]

Hi @RanaKhalil101, Your videos and explanation are really good. It made me understand the basics so much thanks a lot for this!! Reallly i mean it.

[@m0niruzzaman]

Excellent explain ♥️ Thank you!

[@SecurityTalent]

Thank you, sister......

[@mohmedahmed6515]

thank you rana

[@techtutorials7026]

Nice job

[@Phuongang-ti6ch]

Hello, I have a question What's the difference between buying a course and not buying it?

[@user-dh2ev1ry7h]

Thanks

[@the_shafei]

are there ones for XSS please ?

[@karanjoshi7438]

please make videos on OAuth 2

[@motivationvideo6017]

great thanks very much

[@nimamehdipor9109]

Hi, tanks for awsome video , Can you activate the subtitles of your video, it will really help a lot, thank you

[@M0X0101]

waiting from Egypt

[@user-ni7rd7st8z]

It seems that there are no subtitles and cannot be translated, which is a bit troublesome

[@saminbinhumayun858]

Please make videos on xss thank you❤

[@gfernandez2970]

I was wondering if it'd possible to add English subtitles, my sister is deaf, and I'm not pretty good at understanding English (we're from Spain), but both of us can read it. We're aware how good your material is, and it'd me amazing for us if that'd be possible. Thanks a lot in advance!

[@RanaKhalil101]

I wish it was under my control! KZbin automatically generates captions for my videos when I upload them. Unfortunately, for some reason, it didn't upload subtitles for this video :(

[@wispawelwis38]

38:30 So where is the parameter csrf token (the one placed in POST body) stored if not in cookies? In local storage? Cant the attacked steal the csrf cookie?

[@paco7111]

It is part of form in as hidden field

[@wispawelwis38]

@@paco7111 but where is its value stored?

[@omarkhalid2966]

Waiting . . .

[@readypubggo5650]

Awesome,,,,, ....

[@user-gs4bw7gl5d]

i have a question Sister ....i master php and i can also do scripts in python...but as i see in youtube..most youtubers dont encourage php languages!!! i am confused really if i continue in php or i leave it and try to master python..what is your advice Sister and thanks a lot of

[@abdallahelsaed1434]

Why is there no subtital?

[@gurvirsingh4190]

Great ❤️❤️

[@MehediHasan-pv4em]

Please make more videos for us

[@yazeedsalahat9227]

hi rana could you please enable translation Thanks

[@user-gs4bw7gl5d]

salam alaykom ..thanks a lot of Sister

[@defyteryt2452]

This live or vedio recorded

[@kalidsherefuddin]

The greatest

[@ex0day]

Your material is outstanding thanks a lot

[@uionei9083]

please turn on subtitles,

[@noah4347]

Iam waiting

[@nobackupkiwi]

I dont get how sql injections and csrf are related?

[@RanaKhalil101]

They're not.

[@nobackupkiwi]

@@RanaKhalil101 At min 16:50 you said to chain this two methods... I don't understand what you mean by that, could you please elaborate?

[@RanaKhalil101]

@@nobackupkiwi I was referring to chaining two vulnerabilities together assuming that the application is vulnerable to both. If an authenticated page is vulnerable to SQLi and the application does not use a csrf defense, then you can perform an SQLi attack within your CSRF attack in order to possibly gain code execution on the server. A more common example would be chaining a csrf attack with a command injection

[@nobackupkiwi]

@@RanaKhalil101 Clear as water. Thanks for the explanation. I hope there will be csrf+sqli cases in future labs.

[@LearnTermux]

why its showing 8 videos are hidden🥲

[@muhammadhuzaifa8570]

xss please mam

[@basitkhan3853]

From Pakistan 👍

[@soumikdutta6171]

Audio is low.

[@AliKhan-om5st]

Please try to upload videos quickly

[@tuananh5345]

beautiful voice, Indian girl