First checkin for CSRF

(cherry picked from commit a01a767)

webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_GET.adoc

@@ -0,0 +1,10 @@
+== CSRF with a GET request
+
+This is the most easiest CSRF attack to perform. For example you receive an e-mail with the following content:
+
+`<a href="http://bank.com/transfer?account_number_from=123456789&account_number_to=987654321&amount=100000">View my Pictures!</a>`
+
+If the user is still logged in to the website of bank.com this simple GET request will transfer money from one account to another.
+Of course in most cases the website might have multiple controls to approve the request.
+
+

webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_intro.adoc

@@ -0,0 +1,27 @@
+=== What is a Crosse-site request forgery?
+
+Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF
+(sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted
+from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF
+exploits the trust that a site has in a user's browser.
+
+A cross-site request forgery is a confused deputy attack against a web browser. CSRF commonly has the following characteristics:
+
+* It involves sites that rely on a user's identity.
+* It exploits the site's trust in that identity.
+* It tricks the user's browser into sending HTTP requests to a target site.
+* It involves HTTP requests that have side effects.
+
+At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize
+the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site
+that trusts the user and thereby causes an unwanted action.
+
+CSRF attacks target functionality that causes a state change on the server, such as changing the victim's email address or password, or purchasing
+something. Forcing the victim to retrieve data doesn't benefit an attacker because the attacker doesn't receive the response, the victim does.
+As such, CSRF attacks target state-changing requests.
+
+Let's continue with some exercises to address way to perform a CSRF request.
+
+
+
+

webgoat-lessons/csrf/src/main/resources/plugin/CSRF/lessonPlans/en/CSRF_plan.adoc

@@ -0,0 +1,10 @@
+= Cross-site request forgery (CSRF)
+
+== Concept
+
+This lesson teaches how to what a CSRF attack is and how it can be abused and protected against.
+
+== Goals
+
+* The user should have basic knowledge of JavaScript
+* The user will learn to perform a CSRF attack and how to protected against it.