I am a math grad student dabbling in network security. I was playing around with login cross site request forgery, and the whole point is to log somebody in. (I am a complete novice in HTML and JavaScript).

My code thus far:

<form method="Post" action="example.com">

<input type="hidden" name="username" value="NotAHacker" />
  <input type="hidden" name="password" value="H4x0r" />



This code works perfectly, I want to know how to do this, without a window popping up, or at least do it in such a way that the page is blank and the victim is not tipped off of what has happened. I hear JQuery could help with this? Again, I don't know HTML or JavaScript and could use some advice.

  • does not xmlrpc allow post method, without any page reload/refresh? – Dog eat cat world Nov 29 '15 at 2:09
  • you miss understand, (thanks for the answer!) I am carrying out an attack that signs them into my account! While it seems innocuous, apparently add firms do it all the time to track web surfing history. I was just wondering how it was done without my knowledge! Can you explain? I am a html novice, what is the exact code that would hide this? with my other code, it does the job, but the window pops up when I submit the information, I want either a blank page or the page to not exist. thanks again!!! – Cpt Wobbles Nov 29 '15 at 2:17
  • See security.stackexchange.com/questions/105301/… - the question shows how Google does this – Neil Smithline Nov 29 '15 at 3:19
  • You mean AJAX? This is how it is often done. The request is sent in the background, no entry in the browser history. – Daniel Ruf Nov 29 '15 at 9:27
  • @Dogeatcatworld: It would allow the request, however the browser won't be able to read the response in order to set any authentication cookies. This can be useful for other CSRF attacks, but for login CSRF it won't work. – SilverlightFox Nov 30 '15 at 10:24

The easiest way is probably a tiny or hidden iFrame.

Embed an iFrame on your page with a src of your other page containing the CSRF code. The iFrame will get redirected but the user is unlikely to notice because they won't be able to see it.

|improve this answer|||||
  • That's not the point. You log the victim into an account under your own control. That way, if the victim makes changes to the account (I.e. adding payment information), it was done to an account that you fully control and are able to retrieve the data from. – multithr3at3d Nov 29 '15 at 8:20
  • I removed that sentence seeing as it's not relevant to answering the question any way. – thexacre Nov 29 '15 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.