@ihab_medmoun @kylew121 I don't get it either.. In phishing, the attacker creates a fake form that tricks users into handing over their credentials. Once the attacker has those, they can simply log into the user’s account manually. They don’t need to waste effort crafting POST requests to endpoints, as they now have full access.

In contrast, CSRF doesn’t involve capturing credentials. Instead, it tricks users into making an authenticated request they didn’t intend. The attacker leverages the user's active session on a legitimate site to perform actions on their behalf, without ever needing to know their login details. This is why CSRF attacks rely on users already being logged in, whereas phishing does not.

So phishing and CSRF are related in that both are forms of exploitation, but they operate quite differently in terms of technique and what the attacker is trying to achieve. At least this is how I understand it..

Forms and CSRF Explained (with Examples)

Updated Series Available