Lab: the missing token
A transfer form with no token. Fire it from the attacker's seat.
Read the transfer form and notice what is absent. Then issue a transfer exactly as a forged page would: pick a recipient and amount, no token, and watch the bank obey — because from its side, the request carries a valid session and nothing else is checked.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.