Muhammad Asim Shahzad·19h agoThe CSRF Token Nobody CheckedA 2015 Messenger.com disclosure shows that issuing anti-forgery tokens is worthless if the server never verifies them
Excession Labs·1d agoCSRF vulnerability: a local SameSite cookie experimentA CSRF vulnerability lets a page on another site make a logged-in user’s browser send a request that changes state, such as a new account…
Coding Algorithms·Oct 30ColdFusion Session Security: SameSite Cookies, CSRF Tokens, and Session Fixation PreventionMost ColdFusion applications that handle logins, payments, or internal data depend on the session. If an attacker can hijack it, forge a…
Mohammad-Nouri Almohammad·Oct 28From POST-Based XSS to Full Account TakeoverA reflected XSS vulnerability chained with authenticated account management.A response icon1A response icon1
Vansh Baghel·Oct 27CSRF and XSS: How a Valid Login Can Be MisusedA practical explanation of forged requests, injected scripts, and the defenses each needs.
Mohammad-Nouri Almohammad·Oct 26Critical Account Takeover via CSRF Header Bypassبسم الله الرحمن الرحيم — وَمَا بِكُم مِّن نِّعْمَةٍ فَمِنَ اللَّهِ
Atif Waheed·Oct 25Eight Doors, One Key: Chaining Misconfigurations into Full Account TakeoverHow a textbook-secure application, CSRF tokens, SameSite cookies, strict CORS, and a WAF, fell to a single HTML file
Affan Emirhan Çüçen·Oct 21Next.js App Router’da Server Actions ile CSRF Koruması ve Güvenli Oturum YönetimiNext.js App Router’da Server Actions ile CSRF Koruması ve Güvenli Oturum Yönetimi
Abdo Alkaser·Oct 20OAuth Login CSRF via Missing State Validation and Cross-Session Authorization Code Redemption in **…TL;DRA response icon1A response icon1
PRiTi.EX·Oct 15Lab: Performing CSRF exploits over GraphQL #lab5This labs takes my time because i stuck in that URL encode part so lets starts how i solved this lab.
