Account settings — Referer checked
This endpoint rejects requests whose Referer doesn't look like it came from the
site. Supply the Referer your attacker page would send along with your forged request.
Signed in as
victim
Current email on file
victim@cspshivam.com
This site's host
playground.cspshivam.com
Attacker page HTML:
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.