CSRF — TOKEN MISSING

CROSS-SITE REQUEST FORGERY

Victim is logged into bank. Attacker page auto-submits hidden form to transfer funds. Browser sends session cookies — server accepts request without anti-CSRF token validation.

[ ATTACKER PAGE vs VICTIM SESSION ]

Victim Session (logged in)

Balance: $10,000

Cookie: session=abc123xyz

Attacker Page

Hidden form targets bank transfer endpoint

[*] Click "Launch CSRF Attack" to simulate forged request...