Day 18 pentesting -- CSRF still hits harder than people expect.
The browser sends cookies automatically. That is the whole vulnerability. If `bank.com` processes `GET /transfer?to=X&amount=5000`, an attacker just needs:
```html
<img src="https://bank.com/transfer?to=attacker&amount=5000">
```
Victim visits the page, browser fires the request with their session cookie, money moves.
SameSite=Lax cookies fixed cross-origin POST attacks by default. But GET-based state changes? Still wide open.…
