Scenario

POST /my-account/change-email ships a csrf token. Server-side, the token is compared only if the parameter exists — a request without it is accepted.

Your objective

Change the victim's email despite the token. Solved when the victim's email is updated from your hosted page.

Capture 1 flag(s) and record the exact technique for each step.

Getting started

1. Capture the real request, then replay it in Repeater with the csrf value corrupted — observe the 403.
2. Replay again with the csrf parameter deleted entirely — observe the 200.
3. Build the CSRF PoC form with no token field at all.
4. Deliver it to the victim.
5. Submit the new email address as the flag.

Connecting

Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.

Credentials: wiener:peter

Hints