5

I am aware that you can execute a POST request using CSRF using the method below:

<form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post">
    <!-- stuff -->
</form>
<script>document.x.submit();</script>

But this redirects the browser to the target site. Is it possible to execute multiple POST requests using a single CSRF attack?

7

Yep - using an iframe is one approach:

<form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post" target="thing">
<!-- stuff -->
</form>
<iframe name="thing"/>
<script>document.x.submit();</script>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.