What is CSRF?
Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to execute unwanted actions on a web application in which they are currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing.
How to Use the CSRF Generator
1
Target URL: Enter the exact endpoint URL that handles the state-changing action (e.g., changing an email or transferring funds).
2
HTTP Method: Select whether the endpoint expects a GET or POST request.
3
Parameters: Add the exact parameter names and malicious values required by the endpoint.
4
Generate PoC: The HTML Proof of Concept is generated instantly. Copy the code or download the HTML file. When a victim opens this file, their browser will automatically submit the hidden form using their active cookies.
100% Client-Side Privacy
When creating security Proof of Concepts, you don't want to leak target URLs or vulnerability parameters to a third-party server. This CSRF Payload Generator runs entirely in your browser using JavaScript. No data is ever sent over the network, making it a safe tool for penetration testers and bug bounty hunters.