4 ms·
You can do that with POST too if the site doesn't have CSRF protection ;)
by fooyc 14y ago
You can do that with POST too if the site doesn't have CSRF protection ;)
- Kudos 14y agoYou cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.
- 1qaz2wsx3edc 14y agoDrive-by format, that might have to go in my hacker news dictionary of awesome.
- driverdan 14y agoYou can with simple JS posting a hidden iframe. This obviously won't work on 3rd party sites but works just fine from sites you control.