CSRF - Lab #8 CSRF with broken Referer validation | Long Version

In this video, we cover Lab #8 in the CSRF module of the Web Security Academy. This lab's email change functionality is vulnerable to CSRF. It attempts to detect and block cross domain requests, but the detection mechanism can be bypassed. To solve the lab, we use the exploit server to host an HTML page that uses a CSRF attack to change the viewer's email address.

▬ 🌟 Video Sponsor 🌟 ▬▬▬▬▬▬▬▬▬▬
Sign up to Intigriti: https://go.intigriti.com/ranakhalil (affiliate link)

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: https://academy.ranakhalil.com/p/web-...

▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬
00:00 - Introduction
00:14 - Intigriti sponsorship (https://go.intigriti.com/ranakhalil)
01:09 - Navigation to the exercise
01:44 - Understand the exercise and make notes about what is required to solve it
02:43 - Exploit the lab using Burp Suite Pro
13:17 - Script the exploit (without Burp Suite Pro)
18:40 - Summary
18:53 - Thank You

▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
HTML script: https://github.com/rkhal101/Web-Secur...
Notes.txt document: https://github.com/rkhal101/Web-Secur...
CSRF theory video:    • Cross-Site Request Forgery (CSRF) | C...  
Web Security Academy Youtube Video Series Release Schedule: https://docs.google.com/spreadsheets/...
Web Security Academy: https://portswigger.net/web-security/...
Rana's Twitter account:   / rana__khalil