Skip to main content
This page aggregates cross-platform resources to practice CSRF (Cross-Site Request Forgery): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills. Coverage: 19 challenges across 3 platforms — 2 HackTheBox · 15 PortSwigger · 2 TryHackMe. 2 with a Spanish writeup, 2 with a video writeup.

​
Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.
  1. PortSwigger — Basic clickjacking with CSRF token protection (Apprentice) · 🇬🇧
  2. PortSwigger — CSRF vulnerability with no defenses (Apprentice) · 🇬🇧
  3. TryHackMe — Custom Tooling Using Python (Easy · ~60 min) · 🇬🇧
  4. PortSwigger — Bypassing SameSite cookie restrictions (Practitioner) · 🇬🇧
  5. PortSwigger — CSRF where Referer validation depends on header being present (Practitioner) · 🇬🇧
  6. PortSwigger — CSRF where token is duplicated in cookie (Practitioner) · 🇬🇧

​
Curated resources

​
HTB machines practicing CSRF (Cross-Site Request Forgery) (2)

​
PortSwigger labs practicing CSRF (Cross-Site Request Forgery) (15)

​
TryHackMe rooms practicing CSRF (Cross-Site Request Forgery) (2)

← Back to the full glossary Last updated: 2026-08-24