CSRF (Cross-Site Request Forgery)

Cross-platform resources for CSRF (Cross-Site Request Forgery): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice CSRF (Cross-Site Request Forgery): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 19 challenges across 3 platforms — 2 HackTheBox · 15 PortSwigger · 2 TryHackMe. 2 with a Spanish writeup, 2 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Basic clickjacking with CSRF token protection (Apprentice) · 🇬🇧
2. PortSwigger — CSRF vulnerability with no defenses (Apprentice) · 🇬🇧
3. TryHackMe — Custom Tooling Using Python (Easy · ~60 min) · 🇬🇧
4. PortSwigger — Bypassing SameSite cookie restrictions (Practitioner) · 🇬🇧
5. PortSwigger — CSRF where Referer validation depends on header being present (Practitioner) · 🇬🇧
6. PortSwigger — CSRF where token is duplicated in cookie (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/csrf

HTB machines practicing CSRF (Cross-Site Request Forgery) (2)

Machine	OS	Difficulty	Writeup
CrossFit	Linux	INSANE	🇪🇸 🇬🇧 📹
SecNotes	Windows	MEDIUM	🇪🇸 🇬🇧 📹

PortSwigger labs practicing CSRF (Cross-Site Request Forgery) (15)

Lab	Difficulty	Topic	Official
Basic clickjacking with CSRF token protection	APPRENTICE	Clickjacking	Open
CSRF vulnerability with no defenses	APPRENTICE	CSRF (Cross-Site Request Forgery)	Open
Bypassing SameSite cookie restrictions	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where Referer validation depends on header being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where token is duplicated in cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where token is not tied to user session	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where token is tied to non-session cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where token validation depends on request method	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF where token validation depends on token being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
CSRF with broken Referer validation	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
Exploiting XSS to bypass CSRF defenses	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Performing CSRF exploits over GraphQL	PRACTITIONER	GraphQL	Open
SameSite Lax bypass via method override	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
SameSite Strict bypass via client-side redirect	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open
SameSite Strict bypass via sibling domain	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Open

TryHackMe rooms practicing CSRF (Cross-Site Request Forgery) (2)

Room	Difficulty	Type	Access	Official
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Open
NahamStore	MEDIUM	Challenge	🟢 Free	Open

---

← Back to the full glossary

Last updated: 2026-08-24