DARKNET HACKINGINSTITUTION
DH Labs
CLIENT / WEB SECURITY

Cross-Site Request Forgery

Unwanted actions triggered through a signed-in browser.

STUDENT PROGRESS— / 1
AVAILABLE1 labs
PRACTICE PATH

Labs in this topic

1 available Sign in to save progress

01
APPRENTICESIGN IN TO TRACK

Cross-origin profile update

Review a fictional profile update flow and identify the missing cross-site request defense.

APP: Cedar Profile/3 progressive hints
View lab details
DH LABS / LAB BRIEF
APPRENTICESIGN IN TO TRACK

Cross-origin profile update

Review a fictional profile update flow and identify the missing cross-site request defense.

TRAINING APPLICATIONCedar Profile
ENTRY ROUTE/
DIFFICULTYAPPRENTICE
HINTS AVAILABLE3 progressive hints

What you will do

  1. Inspect the request metadata in the scenario evidence.
  2. A signed-in browser sends cookies automatically.
  3. Recommend an unpredictable per-session value checked by the server.
Show full walkthrough and solution
  1. Open the Cedar Profile scenario in the isolated lab.
  2. Review the profile update request and note that no CSRF token or origin validation is present.
  3. Submit csrf-token as the primary missing defense.
  4. The local scenario checker confirms the defensive control; no cross-site request is sent.

Private disposable practice instance, isolated from external services and real accounts. Student login is required to start this lab and track progress.

Lab details are available without an account. Student login is required to start and save progress.