Web App Penetration Testing - #13 - CSRF (Cross Site Request Forgery)

Item: Web App Penetration Testing - #13 - CSRF (Cross Site Request Forgery)
Rating: 4
Author: PostSingularity Institute

by HackerSploit · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information Technology URComputer security

🎙 HackerSploit 👥 1.0M 📅 August 3, 2018 ⏱ 22 min 👁 181K 📄 tutorial 🧭 2026-10-10

Available in: English (current) Français

Keywords

csrfcross site request forgeryburp suiteowasp juice shopweb app pentesting

Summary

This video is part of HackerSploit’s web application penetration testing series, focusing on Cross-Site Request Forgery (CSRF). The host demonstrates how to perform a CSRF attack using Burp Suite against the OWASP Juice Shop, a deliberately vulnerable Node.js web application. He explains the concept of CSRF, emphasizing that it forces an authenticated user to execute unwanted actions. The attack is illustrated by changing a user’s password without knowing the current one. The process involves intercepting a legitimate password change request with Burp Suite, analyzing the GET parameters, and creating a custom script using XMLHttpRequest to send a crafted request. The script is executed via a stored XSS vulnerability in the search bar, effectively combining XSS with CSRF to change the password. The video also covers how to craft a malicious link for remote exploitation and stresses the importance of user authentication for the attack to succeed. The tutorial is practical, step-by-step, and suitable for those learning web security testing.

159 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides a hands-on, clear demonstration of CSRF, connecting theoretical concepts with real-world exploitation. The argumentation is solid: it explains the token-less request vulnerability, shows how to remove the current password parameter, and successfully exploits it. The use of Burp Suite to inspect and manipulate HTTP requests reinforces the practical value. The method of embedding the CSRF payload in a stored XSS script highlights the combination of attack vectors, which is an advanced yet well-explained technique. The host also mentions the necessity of the user being authenticated, a critical condition for CSRF to succeed. Overall, the information is accurate and the reasoning is easy to follow.

Scientific Rigor, Source Quality, Title Accuracy

The title accurately describes the content. The video is a tutorial, and the sources are mostly the tools used: OWASP Juice Shop and Burp Suite, both legitimate and widely known in the security community. The presentation is rigorous: the host demonstrates each step and verifies results by logging in with the new password. The quality of the teaching is high, though the video is from 2018 and some UI details may have changed. The comments show high user satisfaction and appreciation for the detailed explanation. The content aligns with the title without deviation.

215 words

Title / Content Match

The title accurately reflects the content: a focused tutorial on CSRF within the web app penetration testing series, using the specified tools.

Quality & Reliability

7/10

The tutorial is clear, practical, and demonstrates a real attack scenario using Burp Suite and OWASP Juice Shop. The explanation of CSRF is technically accurate and covers the attack mechanism, request manipulation, and exploitation steps. However, the video is from 2018 and some tools or techniques may have evolved, but the core principles remain valid.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

OWASP Juice Shop Project — The vulnerable web application used as the target in the video
HackerSploit Website — Official website of the channel, referenced for support and additional resources
HackerSploit Android App — Mobile application for the channel's content
NordVPN Affiliate Link — Sponsored link for VPN service (publicity) - not used for technical content
The Complete Deep Web Course 2018 — Course promotion mentioned in the description

Concurring Sources

OWASP CSRF Prevention Cheat Sheet — Official OWASP recommendations for mitigating CSRF attacks, consistent with the vulnerabilities demonstrated in the video.

Contribution & Novelties

The video offers a clear, step-by-step tutorial on performing a CSRF attack, combining it with stored XSS to demonstrate a realistic exploitation scenario. It emphasizes the importance of removing authentication parameters and crafting a malicious URL, which is a valuable educational insight. The use of OWASP Juice Shop as a vulnerable target provides a safe and practical environment for learners.

Pour aller plus loin :

OWASP CSRF Prevention Cheat Sheet — Essential reference for understanding CSRF defense mechanisms.
Same-origin policy (Wikipedia) — Core browser security concept that relates to CSRF and XSS.
Cross-site scripting (XSS) - OWASP — Related attack vector used in the demonstration.

105 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with moderate technical depth, indicating a well-balanced tutorial that is accessible yet detailed. The fiabilité is strong due to the practical demonstration on a standard platform.

Reliability 7/10

💬 Très positif : on 30 comments analysés, the vast majority express appreciation for the clear explanation and practical approach, with several requests for more Juice Shop content.