CSRF (Cross-Site Request Forgery)

Recursos cross-platform para CSRF (Cross-Site Request Forgery): máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar CSRF (Cross-Site Request Forgery) de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 19 retos en 3 plataformas — 2 HackTheBox · 15 PortSwigger · 2 TryHackMe. 2 con writeup en español, 2 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Basic clickjacking with CSRF token protection (Apprentice) · 🇬🇧
2. PortSwigger — CSRF vulnerability with no defenses (Apprentice) · 🇬🇧
3. TryHackMe — Custom Tooling Using Python (Easy · ~60 min) · 🇬🇧
4. PortSwigger — Bypassing SameSite cookie restrictions (Practitioner) · 🇬🇧
5. PortSwigger — CSRF where Referer validation depends on header being present (Practitioner) · 🇬🇧
6. PortSwigger — CSRF where token is duplicated in cookie (Practitioner) · 🇬🇧

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/csrf

​

Máquinas HTB que practican CSRF (Cross-Site Request Forgery) (2)

Máquina	SO	Dificultad	Writeup
CrossFit	Linux	INSANE	🇪🇸 🇬🇧 📹
SecNotes	Windows	MEDIUM	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican CSRF (Cross-Site Request Forgery) (15)

Lab	Dificultad	Topic	Oficial
Basic clickjacking with CSRF token protection	APPRENTICE	Clickjacking	Abrir
CSRF vulnerability with no defenses	APPRENTICE	CSRF (Cross-Site Request Forgery)	Abrir
Bypassing SameSite cookie restrictions	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where Referer validation depends on header being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is duplicated in cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is not tied to user session	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is tied to non-session cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token validation depends on request method	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token validation depends on token being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF with broken Referer validation	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
Exploiting XSS to bypass CSRF defenses	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Performing CSRF exploits over GraphQL	PRACTITIONER	GraphQL	Abrir
SameSite Lax bypass via method override	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Strict bypass via client-side redirect	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Strict bypass via sibling domain	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir

​

Rooms TryHackMe que practican CSRF (Cross-Site Request Forgery) (2)

Room	Dificultad	Tipo	Acceso	Oficial
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Abrir
NahamStore	MEDIUM	Challenge	🟢 Free	Abrir

---

← Volver al glosario completo

Última actualización: 2026-08-24