hackXpert labs
All labs › CSRF

🎭 CSRF

You make the victim's browser send the request. Strip the token first, then try a wrong one, an empty one, and somebody else's.

8 labs and targetsfree accountlesson included
How request forgery actually works — taught by The XSS Rat

What it is

CSRF abuses the browser's habit of attaching credentials to any request to a site, so a page you control can act as the victim. SSRF abuses the server's position inside the network, turning it into your proxy to things you cannot reach from outside.

How I attack it

  1. For CSRF: strip the token and see if the endpoint still accepts the request. Then try a wrong token, an empty token, and another user's token.
  2. Check the method and content type - plenty of JSON endpoints happily accept a form post.
  3. For SSRF: anywhere the app fetches a URL is a candidate - webhooks, importers, PDF renderers, image proxies, link previews.
  4. Prove impact beyond a callback: cloud metadata, internal admin panels, ports that should not be reachable.

Learn it from The XSS Rat

▶ Watch: SSRF on YouTube ✍ Read: ssrf on Medium 🎓 Course: Uncle Rat's Ultimate Bug Bounty Guide

Free reference reading

PortSwigger Academy: CSRFPortSwigger Academy: SSRFHackTricks: SSRFPayloadsAllTheThings: SSRF

The graded set 5

Each one tells you its goal and its difficulty when you open it.

CSRF 1

Easy · Forge a cross-site POST to this endpoint and make it return a flag.

CSRF 2

Easy+ · Return the flag by forging a request with any token that has the same length as the real one.

CSRF 3

Medium · Return the flag by forging the request with the exact predictable token.

CSRF 4

Medium+ · Use the exact predictable token and return the flag from an external request.

CSRF 5

Hard · Get the flag by exploiting a substring-based CSRF token check against a random token.

Bonus: credit transfer 2

Credit Transfer - Easy

Bonus Easy · Log in as a victim account and trigger a cross-site credit transfer that returns a flag.

Credit Transfer - Medium

Bonus Medium · Trigger the transfer from an external page and bypass the token check with a fake token of the right length.

Guided application 1

Application

Theme Park CSRF

Your own private park, rebuilt per visitor and wiped after 30 minutes. Build the attacker page and make it fire.

Also here 1

Instructions
Nothing matches thatClear the filter to see everything again.