Sign in
The victim is browsing while logged in. This login form has no CSRF protection. Force the victim's browser to log in as your account, so their activity lands in it.
Victim is currently signed in as
victim
Your attacker account credentials (yours to give away):
username: attackerpassword: hunter2
The app's real login form:
<form method="POST" action="index.php">
<input name="username"> <input type="password" name="password">
</form>
Attacker page HTML:
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.