CSRF Lab: Make a Victim’s Bank Send You Money

The victim is logged in to QuickBank in one tab. In another tab, they open a page you control. Your page quietly submits a form to QuickBank's transfer endpoint, and their browser helpfully attaches their bank session cookie. QuickBank sees a valid, logged-in request and moves $9,999 to your account. The victim never clicks anything on the bank's site. Lab at a glance: Intermediate · 90 XP · about 10 minutes · runs in your browser, no signup or setup.…

Read full article →