Flagship Projects: CSRFGuard
summary
CSRFGuard is a concrete anti‑CSRF library that now supports stateless web apps and offers token per page and single‑use tokens, automatic token injection into dynamically created DOM elements, and stricter refactored Maven modules; release notes list race‑condition fixes and compatibility workarounds. Public exploit search returns about 123 CSRF exploits in the last two years and real attacks include router DNS changes and the Novidad chain. Detection and testing use exploit‑db, nuclei templates, and a shipped test application.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:33What is Cross-Site Request Forgery
- 3:12The classic example
- 4:32More recent CSRF Attack
- 7:39Relaxing the SOP (1)
- 10:33Anything else? Yes, ofCORS!
- 11:17When it's safe to fly?
- 12:58CORS Server side headers
- 14:48Real world CSRF attack payloads
- 16:10Searching for CSRF exploits
- 16:27Searching for recent CSRF exploits
- 16:52How to prevent it?
- 19:46SameSite - the game changer
- 22:25So when would you need CSRF Guaru..
- 24:14CSRF Guard flow (2)
- 27:10What's new in CSRF Guard 4.x
- 30:14CSRF Guard JSP Tag support
- 30:44Conclusions and recommendations
- 33:18Automation with nuclei templates
- 33:33Nuclei detect CSRFGuard defaults
- 34:27References
related talks
45mCSRF: not all defenses are created equal
29mDon't Trust, Verify! - How I Found a CSRF Bug Hiding...
36mCSRF Vulnerabilities Are Still Relevant
40mModern Web Application Defense with OWASP Tools
54mEverything You Wanted to Know About Client side CSRF But Were Afraid to Ask
38mExploiting Client-Side Path Traversal: CSRF Is Dead, Long Live CSRF
31mStranger Danger: Addressing Vulnerable CF Application Dependencies
42mHow to detect CSRF vulnerability, reliably?