CSRF Bank Transfer

Cross-Site Request Forgery (CSRF) is a web security vulnerability that tricks authenticated users into performing unintended actions on a web application. A CSRF tutorial demonstrates how attackers craft malicious web pages that submit requests to vulnerable sites using the victim's existing session. This attack is particularly dangerous in financial applications where unauthorized transfers, password changes, or account modifications can occur without the user's knowledge.

How CSRF Attacks Work

CSRF exploits the trust that a web application has in the user's browser. When a user is logged into a banking site, their browser automatically includes session cookies with every request to that site. An attacker can create a malicious web page containing a hidden form that submits a transfer request to the banking site. If the victim visits this malicious page while logged into their bank, the browser sends the forged request complete with valid session cookies, and the bank processes it as a legitimate transaction.

CSRF Attack Vectors

Attackers deliver CSRF payloads through various methods. Hidden HTML forms with auto-submit JavaScript are the most common technique for POST-based attacks. Image tags and other elements that trigger GET requests can exploit applications that perform state changes via GET. More sophisticated attacks use XMLHttpRequest or fetch API calls, though same-origin policy restrictions limit some of these approaches. Social engineering plays a key role - the attacker must convince the victim to visit the malicious page while authenticated to the target application.

Defenses Against CSRF

The most effective CSRF defense is the synchronizer token pattern, where the server generates a unique, unpredictable token for each session or request and requires it to be included in all state-changing requests. Since the attacker cannot read the token from the target site (blocked by same-origin policy), they cannot include it in their forged request. Additional defenses include SameSite cookie attributes, checking the Origin and Referer headers, and requiring re-authentication for sensitive operations like financial transfers.