> For the complete documentation index, see [llms.txt](https://gowthams.gitbook.io/bughunter-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/csrf.md).

# Cross Site Request Forgery (CSRF)

**Blog / Articles:**

* <http://blog.opensecurityresearch.com/2012/02/json-csrf-with-parameter-padding.html>
* <https://labs.detectify.com/2017/03/15/loginlogout-csrf-time-to-reconsider/>
* <https://medium.com/@secureITmania/how-i-exploit-the-json-csrf-with-method-override-technique-71c0a9a7f3b0>
* <https://labs.detectify.com/2017/03/15/loginlogout-csrf-time-to-reconsider/>
* <https://medium.com/@zseano/site-wide-csrf-issue-chained-with-clickjacking-multiple-sites-vulnerable-6201abab0d3e>
* <https://blog.securityinnovation.com/seven-sins-of-anti-csrf-tokens?utm_campaign=Blog%20Posts&utm_content=135806080&utm_medium=social&utm_source=twitter&hss_channel=tw-213735745>
* <https://medium.com/bugbountywriteup/lets-bypass-csrf-protection-password-confirmation-to-takeover-victim-accounts-d-4a21297847ff>
*

**Bypasses / Cheatsheets:**

![https://twitter.com/hackerscrolls/status/1265217322308046849](/files/-MIQ95wLAXE9M__Z6JNZ)

{% file src="/files/-MIQ8VN\_-wACse--5jeu" %}

* <https://trustfoundry.net/cross-site-request-forgery-cheat-sheet/>

**CSRF MindMap:**

![](/files/-MIQAMy82uFSAwsyQvkj)

**Videos:**

* <https://www.youtube.com/watch?v=eWEgUcHPle0>
* <https://www.youtube.com/watch?v=ULvf6N8AL2A&feature=youtu.be>

{% embed url="<https://twitter.com/jae_hak99/status/1335192935197917185>" %}

![](/files/-MWEPcBVpp_kW_FNRs7J)

ATO using CSRF -Account setting-password change option -We need current password to change new password -capture the request,remove current password and CSRF-Token paramater -Generate CSRF poc -Send it to victim and victim password go changed [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#BugBounty](https://twitter.com/hashtag/BugBounty?src=hashtag_click)

{% embed url="<https://twitter.com/hakluke/status/1350710129671344128?s=20>" %}

{% embed url="<https://twitter.com/Devil79830787/status/1472984805293760514?s=20>" %}