Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.<\/p><\/blockquote>\n
![\"All](\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/07\/All-You-Need-To-Know-About-Cross-Site-Request-Forgery-CSRF-640x480.jpg\")
<\/p>\n
CSRF is often underrated on the risk spectrum but we’ve actually covered some pretty nasty incidents involving CSRF attacks:<\/p>\n
– CSRF Vulnerability in Twitter Allows Forced Following<\/a> And some tools to help test for CSRF vulnerabilities:<\/p>\n – IronWASP \u2013 Open Source Web Security Testing Platform<\/a> Acunetix has come out with a great article explaining it in more depth and also how you can prevent it, it contains information about:<\/p>\n For developers, you should pay special attention to the prevention part and make sure whatever you are building is safe.<\/p>\n There are two approaches by which Cross-site Request Forgery (CSRF) may be prevented \u2013 synchronizing the Cookie with an anti-CSRF token that has already been provided to the browser, or preventing the browser from sending Cookies to the web application in the first-place.<\/p><\/blockquote>\n
\n– Password Manager Security \u2013 LastPass, RoboForm Etc Are Not That Safe<\/a>
\n– Ubiquiti Wi-Fi Gear Hackable Via 1997 PHP Version<\/a><\/p>\n
\n– Hcon Security Testing Framework (HconSTF) v0.4 \u2013 Fire Base<\/a>
\n– xssless \u2013 An Automated XSS Payload Generator Written In Python<\/a><\/p>\n\n
\n