Building and Using CSRF PoCs

A CSRF proof of concept is just a short HTML snippet that, when executed by a user, will take advantage of the weak CSRF defence and change the application state in unexpected or unwanted ways, validating the vulnerability.

Creating a CSRF PoC Code Snippet

As the basis for building a CSRF PoC snippet, let's go back to a form on the deliberately-vulnerable web app, webscantest.com, that's vulnerable to both XSS and CSRF:

Now we can fill in the values for our form, entering the information for one William Private Mandella Mandella:

In order to build our CSRF PoC, it can be helpful to see the form as an HTTP action, so we can grab the type of data-encoding, HTTP verb, and form-field information...