Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a way to forge post request without being redirected to the page where parameters are submitted.For example :

<html>
<head>
<title>
CRSF example
</title>
</head>
<body onload="">
<form action="http://www.somesite.org/action.php" method="POST">

    <input type="hidden" name="money" value="10000$"/>
    <input type="hidden" name="payment" value="Paypal"/>
    <input type="hidden" name="user" value="user1"/>
    <input type="submit" name="submit" value="Withdraw"/>

</form>
</body>
</html>

When user visits this page csrf is activated and values are sent and redirection happens.Can these valuse be sent without redirection.Thanks

share|improve this question
1  
You could load this in an iframe. –  CodesInChaos Oct 21 '12 at 22:13
    
How do I do that? –  user1203028 Oct 23 '12 at 20:59
1  
@user1203028, any good HTML tutorial should provide information about how to create an IFRAME in your HTML document. Do a little googling; once you see how to do it, you'll see it's really easy! –  D.W. Oct 23 '12 at 21:51
    
did it , messed up iframe css values so it didn't show anything.Thanks for help. –  user1203028 Oct 23 '12 at 22:00
add comment

2 Answers

up vote 2 down vote accepted

Normally a post based CSRF exploit has a line of javascript: document.getElementById("csrf_form").submit() to submit the form without user interaction. CSRF exploits (and many XSS exploits) are normally loaded within an invisible iframe so that the user has no idea that the browser made the request.

share|improve this answer
add comment

I can't tell precisely what you are asking, but here is a basic fact that will probably answer your specific question

Any web site (evil.com) on the Internet can cause the user's web browser to send a POST request to any other web site (somesite.org). evil.com can't view the response, but that's OK. This ability is enough to mount a CSRF attack, if somesite.org has not used appropriate defenses (e.g., CSRF tokens).

I suggest reading OWASP's resources and other basic tutorials on CSRF, since this is a basic fact about how web security works.

share|improve this answer
    
I know that requests can be forged , I just wanted to know how to submit forged page post parameters without user knowing it , forging get request is easy but if you forge post request you get redirected. –  user1203028 Oct 23 '12 at 20:56
1  
OK @user1203028, sorry, didn't realize that was what you were looking for. The answer: You can create a 1x1-pixel IFRAME and do your form submission in that IFRAME. Then the user won't notice. –  D.W. Oct 23 '12 at 21:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.