Is there a way to forge post request without being redirected to the page where parameters are submitted.For example :

CRSF example
<body onload="">
<form action="http://www.somesite.org/action.php" method="POST">

    <input type="hidden" name="money" value="10000$"/>
    <input type="hidden" name="payment" value="Paypal"/>
    <input type="hidden" name="user" value="user1"/>
    <input type="submit" name="submit" value="Withdraw"/>


When user visits this page csrf is activated and values are sent and redirection happens.Can these valuse be sent without redirection.Thanks

  • 1
    You could load this in an iframe. – CodesInChaos Oct 21 '12 at 22:13
  • How do I do that? – Daniel Oct 23 '12 at 20:59
  • 1
    @user1203028, any good HTML tutorial should provide information about how to create an IFRAME in your HTML document. Do a little googling; once you see how to do it, you'll see it's really easy! – D.W. Oct 23 '12 at 21:51
  • did it , messed up iframe css values so it didn't show anything.Thanks for help. – Daniel Oct 23 '12 at 22:00

Normally a post based CSRF exploit has a line of javascript: document.getElementById("csrf_form").submit() to submit the form without user interaction. CSRF exploits (and many XSS exploits) are normally loaded within an invisible iframe so that the user has no idea that the browser made the request.


I can't tell precisely what you are asking, but here is a basic fact that will probably answer your specific question

Any web site (evil.com) on the Internet can cause the user's web browser to send a POST request to any other web site (somesite.org). evil.com can't view the response, but that's OK. This ability is enough to mount a CSRF attack, if somesite.org has not used appropriate defenses (e.g., CSRF tokens).

I suggest reading OWASP's resources and other basic tutorials on CSRF, since this is a basic fact about how web security works.

  • I know that requests can be forged , I just wanted to know how to submit forged page post parameters without user knowing it , forging get request is easy but if you forge post request you get redirected. – Daniel Oct 23 '12 at 20:56
  • 1
    OK @user1203028, sorry, didn't realize that was what you were looking for. The answer: You can create a 1x1-pixel IFRAME and do your form submission in that IFRAME. Then the user won't notice. – D.W. Oct 23 '12 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.