What's with cross-site request forgery? A decade ago it was supposed to be a "sleeping giant", preparing to wake and inflict havoc upon the worldwide web application landscape. But the doomsday scenario never materialized and you don't even seem to hear much about it anymore. In this talk, 10 years after disclosing massive CSRF vulnerabilities in Netflix's main website, I will cover all things CSRF! We'll discuss why hackers are or aren't exploiting CSRF, data breaches that may or may not have occurred due to CSRF, review CSRF protection mechanisms built into many modern development frameworks, and look at how WAFs (web application firewalls) and RASP (run-time application protection) can potentially be leveraged to block CSRF attacks. I'll also cover how black-box scanning tools test for CSRF vulnerabilities and discuss their false positive/false negative rates. Finally, I'll demonstrate some manual testing techniques with Burp to help you quickly identify CSRF issues.