4 ms·
Isn't this basically CSRF-as-a-service?
by avian 10y ago
Isn't this basically CSRF-as-a-service?
- griffinmb 10y agoCould be useful for proof-of-concepts. Though, if you are a site-owner and your form can be submitted with this, you should probably consider implementing anti-csrf protections.
- y7 10y agoBut without the cookies.
- EJTH 10y agoGood point.
- niftich 10y ago> This service works by providing a hidden form that is built on page-load and uses javascript to 'click' the form submission. This means cookies will work correctly for the site you've submitted to, but you need to have a javascript enabled browser to use the service. So, with cookies.
- EJTH 10y agoThat was exactly what I was thinking, you don't even need to create an account or anything it seems.
- lima 10y agoGreat for pentesting!