This lab's email change functionality is vulnerable to CSRF.
To solve the lab, craft some HTML that uses a to change the viewer's email address and upload it to your exploit server.
You can log in to your own account using the following credentials: wiener:peter
After accessing the lab, I intercepted the change email request and sent it to the repeater in Burp Suite:
My goal was to change the victim's email address, so I decided to host a malicious page that would automatically submit the change email form from the lab when accessed. First, I needed to craft a CSRF exploit, and to do that, I used the built into , which is very useful and saves time, though it’s possible to write the PoC manually.
By right-clicking the request and selecting Engagement tools / Generate CSRF PoC, I generated the following HTML:
I modified the email value to a new one to avoid any issues indicating that the email was already in use. Then, I copied and pasted this HTML into my exploit server.
After clicking Store and Deliver exploit to victim, I saw that the lab was solved, confirming the change of the victim's email.