I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an email message that sends two malicious requests to a web app the that the recipient is logged in to. The first request sets a money transfer amount. The second is a confirmation request sent when the user would click "confirm" on a confirmation page.