Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

In this example, the vulnerable application implements CSRF protection with a token rendered into a form field on the page. We will see how CSS injection permits this token to be stolen one character at a time -- because the field is rendered, its value can trigger background requests.

www.nerdpress.com/blog/edit

NerdPress

Settings

CSRF Token
HTML 
<!-- The CSRF token is rendered into a field on the profile form -->
<form action="/profile/save" method="post">
  <input name="csrf-token" value="9k2mX8qL4nR7pF1v" />

  <label>Bio</label>
  <textarea name="bio"></textarea>

  <button type="submit">Save Profile</button>
</form>