2

Is there a way to forge post request without being redirected to the page where parameters are submitted.For example :

<html>
<head>
<title>
CRSF example
</title>
</head>
<body onload="">
<form action="http://www.somesite.org/action.php" method="POST">

    <input type="hidden" name="money" value="10000$"/>
    <input type="hidden" name="payment" value="Paypal"/>
    <input type="hidden" name="user" value="user1"/>
    <input type="submit" name="submit" value="Withdraw"/>

</form>
</body>
</html>

When user visits this page csrf is activated and values are sent and redirection happens.Can these valuse be sent without redirection.Thanks

Improve this question
4
  • 1
    You could load this in an iframe.
    – CodesInChaos
    Commented Oct 21, 2012 at 22:13
  • How do I do that?
    – Daniel
    Commented Oct 23, 2012 at 20:59
  • 1
    @user1203028, any good HTML tutorial should provide information about how to create an IFRAME in your HTML document. Do a little googling; once you see how to do it, you'll see it's really easy!
    – D.W.
    Commented Oct 23, 2012 at 21:51
  • 1
    did it , messed up iframe css values so it didn't show anything.Thanks for help.
    – Daniel
    Commented Oct 23, 2012 at 22:00

2 Answers 2

Reset to default
5

Normally a post based CSRF exploit has a line of javascript: document.getElementById("csrf_form").submit() to submit the form without user interaction. CSRF exploits (and many XSS exploits) are normally loaded within an invisible iframe so that the user has no idea that the browser made the request.

Improve this answer
2

I can't tell precisely what you are asking, but here is a basic fact that will probably answer your specific question

Any web site (evil.com) on the Internet can cause the user's web browser to send a POST request to any other web site (somesite.org). evil.com can't view the response, but that's OK. This ability is enough to mount a CSRF attack, if somesite.org has not used appropriate defenses (e.g., CSRF tokens).

I suggest reading OWASP's resources and other basic tutorials on CSRF, since this is a basic fact about how web security works.

Improve this answer
2
  • I know that requests can be forged , I just wanted to know how to submit forged page post parameters without user knowing it , forging get request is easy but if you forge post request you get redirected.
    – Daniel
    Commented Oct 23, 2012 at 20:56
  • 1
    OK @user1203028, sorry, didn't realize that was what you were looking for. The answer: You can create a 1x1-pixel IFRAME and do your form submission in that IFRAME. Then the user won't notice.
    – D.W.
    Commented Oct 23, 2012 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .