Forum Discussion
Bronze IIHelp with Cross Site Request Forgery (Twooter)
Hi folks,
I'm having a hard time getting past the Cross Site Request Forgery lab - specifically I'm not sure what sort of payload I can use to obtain the username of the scraper. I can get their IP address using just a link and I've tried a range of scripts hosted on my machine which I then link to in my 'twoots' but there's no connection at all. I'd be really grateful for any direction as to the sort of payload that could capture the necessary information.
Thanks,
Jonathan
Oh OK. You don't need to try and send anything back to your kali box - just craft a link that when clicked will send a message to the message board.
4 Replies
- barney
Bronze III
Don't overthink it.
You'll observe that when a user submits a twoot their username is displayed along with the message.
So, if you can submit a payload that replicates submitting a twoot, the username of anyone who interacts with it should be displayed.
joneillHi Barney
Thanks for coming back to me. I really appreciate the steer but I'm still pretty stuck on what that sort of payload would look like. I just fed the existing html for the submit button back, but pointed to my server - I get connections back but they don't include the required data. Below is what I'm sending and seeing in response.Check out this link <a href=http://10.102.124.10:5555> <input type="submit" name="submit"></a>connect to [10.102.124.10] from (UNKNOWN) [10.102.82.247] 59456 GET / HTTP/1.1 Host: 10.102.124.10:5555 User-Agent: python-requests/2.25.1 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive- barney
Oh OK. You don't need to try and send anything back to your kali box - just craft a link that when clicked will send a message to the message board.
