On-site request forgery
portswigger.net | vulnerability | #web-security | #xss | #portswigger | #csrf | #osrf | #stored-attacks | #request-forgery
Summary
Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.
- Published
- Collected
--- id: 2324 title: "On-site request forgery" source_domain: portswigger.net source_url: "https://portswigger.net/blog/on-site-request-forgery" published_at: "2007-05-03T08:09:00Z" tags: ["web-security", "xss", "portswigger", "csrf", "osrf", "stored-attacks", "request-forgery"] phying_url: "https://phying.com/item/2324" lang: en --- # On-site request forgery ## Summary Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page. ## Intelligence Metadata - **Sources:** portswigger.net - **Published:** 2007-05-03T08:09:00Z - **Original:** https://portswigger.net/blog/on-site-request-forgery - **Phying News:** https://phying.com/item/2324