Cross-Site Request Forgery Demo Shows How Hidden Forms Abuse Logged-In Sessions

Summary

A tutorial demonstrates how a deceptive link can trigger a logged-in user’s browser to submit a message through a hidden form, then shows how JavaScript can automate submission and how to inspect the resulting request.

Key points

• The presenter explains that a victim’s existing session can be used to perform actions on a website when they follow a deceptive link.
• A demonstration uses a fake prize page and a messaging application to submit a message as a logged-in test account.
• The initial form requires the user to click a button; added JavaScript automatically submits the form when the page loads.
• The presenter inspects the browser’s network activity to show the POST request and submitted message.