4

I am a math grad student dabbling in network security. I was playing around with login cross site request forgery, and the whole point is to log somebody in. (I am a complete novice in HTML and JavaScript).

My code thus far:

<form method="Post" action="example.com">

<input type="hidden" name="username" value="NotAHacker" />
  <input type="hidden" name="password" value="H4x0r" />

</form>

<script> 
    document.forms[0].submit();
</script>  

This code works perfectly, I want to know how to do this, without a window popping up, or at least do it in such a way that the page is blank and the victim is not tipped off of what has happened. I hear JQuery could help with this? Again, I don't know HTML or JavaScript and could use some advice.

5
  • does not xmlrpc allow post method, without any page reload/refresh? Nov 29, 2015 at 2:09
  • you miss understand, (thanks for the answer!) I am carrying out an attack that signs them into my account! While it seems innocuous, apparently add firms do it all the time to track web surfing history. I was just wondering how it was done without my knowledge! Can you explain? I am a html novice, what is the exact code that would hide this? with my other code, it does the job, but the window pops up when I submit the information, I want either a blank page or the page to not exist. thanks again!!! Nov 29, 2015 at 2:17
  • See security.stackexchange.com/questions/105301/… - the question shows how Google does this Nov 29, 2015 at 3:19
  • You mean AJAX? This is how it is often done. The request is sent in the background, no entry in the browser history.
    – user6090
    Nov 29, 2015 at 9:27
  • @Dogeatcatworld: It would allow the request, however the browser won't be able to read the response in order to set any authentication cookies. This can be useful for other CSRF attacks, but for login CSRF it won't work. Nov 30, 2015 at 10:24

1 Answer 1

1

The easiest way is probably a tiny or hidden iFrame.

Embed an iFrame on your page with a src of your other page containing the CSRF code. The iFrame will get redirected but the user is unlikely to notice because they won't be able to see it.

2
  • That's not the point. You log the victim into an account under your own control. That way, if the victim makes changes to the account (I.e. adding payment information), it was done to an account that you fully control and are able to retrieve the data from. Nov 29, 2015 at 8:20
  • I removed that sentence seeing as it's not relevant to answering the question any way.
    – thexacre
    Nov 29, 2015 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .