Skip to content

Latest commit

 

History

History
21 lines (11 loc) · 864 Bytes

README.md

File metadata and controls

21 lines (11 loc) · 864 Bytes

An example mailicious page used to create CSRF attack on NodeGoat App

Usage:

  1. The app is hosted on heroku at - https://nodegoat-csrf-attack.herokuapp.com. You can either use the hosted instance, or clone this app and run it locally. If hosted locally, to launch the app from the Terminal:

    $ node server.js

  2. The default target of this app is OWASP NodeGoat project Heroku instance at https://nodegoat.herokuapp.com. However, it can be pointed to another instance of NodeGoat application by sending target query param in the url with server name

Examples:

By default, it sends POST request to https://nodegoat.herokuapp.com/profile

To change the target NodeGoat App instance to localhost, use URL: http://nodegoat-csrf-attack.herokuapp.com?target=http://localhost:3000

This will send POST request to http://localhost:3000/profile