> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# CSRF (Cross-Site Request Forgery)

> Recursos cross-platform para CSRF (Cross-Site Request Forgery): máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

# CSRF (Cross-Site Request Forgery)

Esta página agrega los **recursos para practicar CSRF (Cross-Site Request Forgery)** de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

## Recursos curados

| Fuente      | Enlace                                                                                 |
| ----------- | -------------------------------------------------------------------------------------- |
| PortSwigger | [https://portswigger.net/web-security/csrf](https://portswigger.net/web-security/csrf) |

## Máquinas HTB que practican CSRF (Cross-Site Request Forgery) (2)

| Máquina                                          | SO      | Dificultad                                           |
| ------------------------------------------------ | ------- | ---------------------------------------------------- |
| [CrossFit](/htb/machines/linux/insano/crossfit)  | Linux   | <span className="dbadge dbadge-insane">INSANE</span> |
| [SecNotes](/htb/machines/windows/medio/secnotes) | Windows | <span className="dbadge dbadge-medium">MEDIUM</span> |

## Labs PortSwigger que practican CSRF (Cross-Site Request Forgery) (15)

| Lab                                                                                                                                                                         | Dificultad                                                 | Topic                             | Oficial                                                                                                                                    |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| [Basic clickjacking with CSRF token protection](/portswigger/labs/clickjacking/basic-csrf-protected)                                                                        | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Clickjacking                      | [Abrir](https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected)                                                        |
| [CSRF vulnerability with no defenses](/portswigger/labs/csrf/no-defenses)                                                                                                   | <span className="dbadge dbadge-easy">APPRENTICE</span>     | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/lab-no-defenses)                                                                         |
| [CSRF where Referer validation depends on header being present](/portswigger/labs/csrf/bypassing-referer-based-defenses-referer-validation-depends-on-header-being-present) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-depends-on-header-being-present) |
| [CSRF where token is duplicated in cookie](/portswigger/labs/csrf/bypassing-token-validation-token-duplicated-in-cookie)                                                    | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-duplicated-in-cookie)                               |
| [CSRF where token is not tied to user session](/portswigger/labs/csrf/bypassing-token-validation-token-not-tied-to-user-session)                                            | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-not-tied-to-user-session)                           |
| [CSRF where token is tied to non-session cookie](/portswigger/labs/csrf/bypassing-token-validation-token-tied-to-non-session-cookie)                                        | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie)                         |
| [CSRF where token validation depends on request method](/portswigger/labs/csrf/bypassing-token-validation-token-validation-depends-on-request-method)                       | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-request-method)               |
| [CSRF where token validation depends on token being present](/portswigger/labs/csrf/bypassing-token-validation-token-validation-depends-on-token-being-present)             | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-token-being-present)          |
| [CSRF with broken Referer validation](/portswigger/labs/csrf/bypassing-referer-based-defenses-referer-validation-broken)                                                    | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-broken)                          |
| [Exploiting XSS to bypass CSRF defenses](/portswigger/labs/cross-site-scripting/exploiting-perform-csrf)                                                                    | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Cross-Site Scripting (XSS)        | [Abrir](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf)                                             |
| [Performing CSRF exploits over GraphQL](/portswigger/labs/graphql/graphql-csrf-via-graphql-api)                                                                             | <span className="dbadge dbadge-medium">PRACTITIONER</span> | GraphQL                           | [Abrir](https://portswigger.net/web-security/graphql/lab-graphql-csrf-via-graphql-api)                                                     |
| [SameSite Lax bypass via cookie refresh](/portswigger/labs/csrf/bypassing-samesite-restrictions-samesite-strict-bypass-via-cookie-refresh)                                  | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-cookie-refresh)           |
| [SameSite Lax bypass via method override](/portswigger/labs/csrf/bypassing-samesite-restrictions-samesite-lax-bypass-via-method-override)                                   | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-lax-bypass-via-method-override)             |
| [SameSite Strict bypass via client-side redirect](/portswigger/labs/csrf/bypassing-samesite-restrictions-samesite-strict-bypass-via-client-side-redirect)                   | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-client-side-redirect)     |
| [SameSite Strict bypass via sibling domain](/portswigger/labs/csrf/bypassing-samesite-restrictions-samesite-strict-bypass-via-sibling-domain)                               | <span className="dbadge dbadge-medium">PRACTITIONER</span> | CSRF (Cross-Site Request Forgery) | [Abrir](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-sibling-domain)           |

## Rooms TryHackMe que practican CSRF (Cross-Site Request Forgery) (2)

| Room                                                                | Dificultad                                         | Tipo        | Acceso  | Oficial                                                 |
| ------------------------------------------------------------------- | -------------------------------------------------- | ----------- | ------- | ------------------------------------------------------- |
| [Custom Tooling Using Python](/tryhackme/rooms/customtoolingpython) | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/customtoolingpython) |
| [NahamStore](/tryhackme/rooms/nahamstore)                           | <span className="dbadge dbadge-easy">MEDIUM</span> | Challenge   | 🟢 Free | [Abrir](https://tryhackme.com/room/nahamstore)          |

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"CSRF (Cross-Site Request Forgery)","termCode":"csrf","inLanguage":"es","url":"https://rootea.es/skills/csrf","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"Máquinas HTB que practican CSRF (Cross-Site Request Forgery)","numberOfItems":2,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/htb/machines/linux/insano/crossfit","name":"CrossFit"},{"@type":"ListItem","position":2,"url":"https://rootea.es/htb/machines/windows/medio/secnotes","name":"SecNotes"}]}`}
</script>

*Última actualización: 2026-06-07*