Progress

0 / 13 bypasses demonstrated this session.

Demonstrate every client-trust bypass to clear Module 05. Use the PoC Tester to fire the shapes.

⬜ GET-based CSRF — a state change fired on GET (img-exploitable)

⬜ POST CSRF — state-changing POST with no anti-CSRF token

⬜ Token present but never validated — blank / arbitrary token accepted

⬜ Token not session-bound — another account's token accepted

⬜ Static / reusable token — the same token was replayed and accepted

⬜ Validation skipped when the token param is absent (drop the field)

⬜ SameSite gap — the session cookie rode along on a cross-site request

⬜ No Origin / Referer validation — a foreign / blank Origin was accepted

⬜ JSON CSRF — body parsed as JSON regardless of Content-Type (no preflight)

⬜ Method-override CSRF — a plain POST reached a DELETE/PUT action

⬜ Chain: CSRF change-email → account-takeover primitive (no re-auth)

⬜ Clickjacking — sensitive page ships no X-Frame-Options / frame-ancestors

⬜ Client-side-only captcha — the server never verifies it