Add feature 2

[cwong-scw]

sqli

[cwong-scw]

xss

[cwong-scw]

csrf

[temp-scw-app[bot]]

Micro-Learning Topic: Cross-site request forgery (Detected by phrase)

Matched on "csrf"

What is this? (2min video)

Session-related but not session-based, this attack is based on the ability of an attacker to force an action on a user’s browser (commonly in the form of a POST request) to perform an unauthorized action on behalf of the user. This can often occur without the user even noticing it… or only noticing when it is too late. The root cause is that browsers automatically send session cookies with all requests to a given domain, regardless of where the source of the request came from, and the application server cannot differentiate between a request that came from pages it served or a request that came from an unrelated page.

Try this challenge in Secure Code Warrior

[cwong-scw]

ssrf

[cwong-scw]

csrf ssrf

[temp-scw-app[bot]]

Micro-Learning Topic: Cross-site request forgery (Detected by phrase)

Matched on "csrf"

What is this? (2min video)

Session-related but not session-based, this attack is based on the ability of an attacker to force an action on a user’s browser (commonly in the form of a POST request) to perform an unauthorized action on behalf of the user. This can often occur without the user even noticing it… or only noticing when it is too late. The root cause is that browsers automatically send session cookies with all requests to a given domain, regardless of where the source of the request came from, and the application server cannot differentiate between a request that came from pages it served or a request that came from an unrelated page.

Try this challenge in Secure Code Warrior