Capture the FlagMedium
Silent Admin Change
Lab for CSRF: Tricking a User Into Doing Something
Scenario
An admin is logged into the app settings page at `/admin/settings`. The 'Change Timezone' function accepts GET requests: `GET /admin/settings/timezone?tz=UTC`. Craft an HTML payload that silently changes the timezone to `AttackedByCSRF` when the admin's browser loads it.
Objective
Craft a CSRF payload that tricks an admin into changing a setting without their knowledge.
lab ~ silent admin changenothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.