# TryHackMe - Nahamstore

* [Room](https://tryhackme.com/room/nahamstore)

## Recon

### tips and general things to try

* You can browse all the website with burp you can even make a crawl scan.
* You can make an account and browse again with burp

### wfuzz

* You can subdomain enum with wfuzz `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://nahamstore.thm/' -H "HOST:FUZZ.nahamstore.thm"` inspecting the results we can see that we need filter it with `--hw 65`

```txt
┌─[✗]─[gabrielle@parrot]─[~]
└──╼ $wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://nahamstore.thm/' -H "HOST:FUZZ.nahamstore.thm" --hw 65
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://nahamstore.thm/
Total requests: 4989

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                      
=====================================================================

000000001:   301        7 L      13 W       194 Ch      "www - www"                                                                                                                  
000000037:   301        7 L      13 W       194 Ch      "shop - shop"                                                                                                                
000000254:   200        41 L     92 W       2025 Ch     "marketing - marketing"                                                                                                      
000000960:   200        0 L      1 W        67 Ch       "stock - stock"                                                                                                              

Total time: 206.7410
Processed Requests: 4989
Filtered Requests: 4985
Requests/sec.: 24.13163
```

* Once we get our results we need to add the to the `/etc/hosts` file
* shop and www redirects to the website we already have
* Marketing gives this

![marketing](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-f4dc4d7f3f9df8023f23bade0b1a39c6bc6df666%2F2023-06-23-16-47-49.png?alt=media)

* Stock gives this really interesting results worth keeping aside for further investigation

![stock api](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-65f9caed75356cfe44c70a189ef0873539a91151%2F2023-06-23-16-48-59.png?alt=media)

* And if we access /product from there we get this

![products](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-ade5f095b4fd286561d2de8fa18dcbc91c2dcb92%2F2023-06-23-16-50-13.png?alt=media)

### gobuster

```txt
┌─[✗]─[gabrielle@parrot]─[~]
└──╼ $gobuster dir -u http://nahamstore.thm/ -w /usr/share/seclists/Discovery/Web-Content/big.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://nahamstore.thm/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2023/06/23 15:33:55 Starting gobuster in directory enumeration mode
===============================================================
/basket               (Status: 200) [Size: 2465]
/css                  (Status: 301) [Size: 178] [--> http://127.0.0.1/css/]
/js                   (Status: 301) [Size: 178] [--> http://127.0.0.1/js/] 
/login                (Status: 200) [Size: 3099]                           
/logout               (Status: 302) [Size: 0] [--> /]                      
/register             (Status: 200) [Size: 3138]                           
/returns              (Status: 200) [Size: 3628]                           
/robots.txt           (Status: 200) [Size: 13]                             
/search               (Status: 200) [Size: 3351]                           
/staff                (Status: 200) [Size: 2287]                           
/uploads              (Status: 301) [Size: 178] [--> http://127.0.0.1/uploads/]
                                                                               
===============================================================
2023/06/23 15:45:45 Finished
===============================================================
```

* We did not have the page staff let's check it out

![staff](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-dafa62c031247d1a476b91868829f166844d02c7%2F2023-06-23-17-01-34.png?alt=media)

* Pretty juicy, let's keep it in mind for later

### nmap

I wanted to make an nmap scan to make sure I did not miss anything

```txt
nmap nahamstore.thm -sC -sV
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-24 13:33 EDT
Nmap scan report for nahamstore.thm (10.10.186.158)
Host is up (0.38s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 846e52cadb9edf0aaeb5703d07d69178 (RSA)
|   256 1a1ddbca998a64b18b10dfa939d55cd3 (ECDSA)
|_  256 f63616b7668e7b350907cb90c9846338 (ED25519)
80/tcp   open  http    nginx 1.14.0 (Ubuntu)
|_http-title: NahamStore - Home
| http-cookie-flags: 
|   /: 
|     session: 
|_      httponly flag not set
|_http-server-header: nginx/1.14.0 (Ubuntu)
8000/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-open-proxy: Proxy might be redirecting requests
| http-robots.txt: 1 disallowed entry 
|_/admin
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 58.96 seconds
```

* This way we get this page on port 8000 `http://nahamstore.thm:8000/admin/login`

![admin login](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-12252e40df2aa021fa832899c56abf14a2c513e8%2F2023-06-24-13-43-36.png?alt=media)

### Summary

#### Subdomains

* Here is what I have in my hosts file so far

```txt
10.10.186.158 nahamstore.thm something.nahamstore.thm www.nahamstore.thm shop.nahamstore.thm marketing.nahamstore.thm stock.nahamstore.thm
```

* nahamstore.thm
* www.nahamstore.thm (same as the 1st one)
* shop.nahamstore.thm (same as the 1est one)
* marketing.nahamstore.thm
* stock.nahamstore.thm

#### Pages to keep aside for later and notes

* `http://nahamstore.thm:8000/admin/login`
* `http://nahamstore.thm/staff`

Using gobuster, I did not find anything under marketing and under store I only got the page product that I had already found.

I just could not find the answer for the first question (I think I missed a subdomain or something) so I moved to the next one planning on getting back to it later.

## XSS

### Vulnerable endpoint

If we play around in marketing when we tamper with the url of one of the campaign we get an url with an interesting parameter that reflects its value in the page.

![error](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-b5dbb48b963003bf9bf34607bc5fe0b03e5cc2fe%2F2023-06-26-08-37-47.png?alt=media)

If we inject there, we get a reflected xss

![Injected Alert executed](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-fabae4251b5058a28fc6c3a94bffdc5a6060a0cc%2F2023-06-26-08-39-32.png?alt=media)

### User-Agent

When we place an order it stores the user agent in the database and it is reflected to us

![user agent](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-f1a5034e4c5bbe5308fd69e7ec737c977b62e1b5%2F2023-06-24-17-39-16.png?alt=media)

So if we inject in this header we get a stored XSS

![Edited request](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-ec6ea1433b065182a242bdd285ec87efa7e3f9f3%2F2023-06-24-17-42-51.png?alt=media)

![Pop up](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-a8d862b81f368594a34d75ba6065012c1e17f1c1%2F2023-06-24-17-42-05.png?alt=media)

### Id parameter

When looking for XSS we can see that the parameter id is vulnerable to both XSS and SQL injection.\
URL with injection point `http://nahamstore.thm/product?id=%3Cscript%3Ealert(1)%3C/script%3E&name=blah`

* Javascript executed

![alert popped](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-2bd51a5ed0f5b62c4ab0da696288dbc9ba0fb9f6%2F2023-06-24-15-45-49.png?alt=media)

* SQL Error

![SQL error](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-8ebbd0ef2694f9f97c3410558201837dba122650%2F2023-06-24-15-47-48.png?alt=media)

This way we know it is using MySQL\
We can keep this aside for the SQLi question later.

### Hidden parameter

* There's a question asking about a hidden parameter in the home page. If we check in the code using F12 we can find a form with a hidden `q` parameter.

![hidden parameter](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-3d396b7ea5b1a18b0058dcf8cae9f93dc88ba740%2F2023-06-24-15-50-47.png?alt=media)

Let's try to make it pop an alert.

Our brackets are removed but if we use double quotes we move away form the search box

* Request

![Request](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-199d823c133eb548938054e9b85ff1fdf8595f4e%2F2023-06-24-15-56-48.png?alt=media)

* Response

![Response](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-6da8e05c22d159f232748d650635428702bdec19%2F2023-06-24-15-57-33.png?alt=media)

What ended up to work was trying to inject in the search field `';alert(1);'` don't forget the last semi-colon it kinda drove me crazy lol

![alert](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-88305dc3d4a3522a14c05d281ce1ec9a7bfbf7cf%2F2023-06-24-17-08-02.png?alt=media)

### H1 tag

When trying a few things out and tampering with the url we get a Page Not Found 404. If we inject inside the h1 tag we get an XSS

![Page Not Found](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-e60b3090e8830763bd6823451b6930557776fc67%2F2023-06-26-09-03-41.png?alt=media)

Here is the edited response

![Edited response](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-bc642753516b40655af266bf9f55c5a69474c5dc%2F2023-06-26-09-07-51.png?alt=media)

> Note that if we inject like this it also works `http://nahamstore.thm/%3Cscript%3Ealert(1)%3C/script%3E`

### Other hidden parameter

To answer this question I used [arjun](https://github.com/s0md3v/Arjun/wiki/Usage) to fuzz for possible hidden parameter.\
It was a good opportunity to try it out. It is quite efficient as it found really quickly the other hidder parameter that we found before.

![arjun](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-5740ec34e3de9982db7224ea99a1198cd1112ca3%2F2023-06-26-09-28-49.png?alt=media)

Even though this tool is really good, it is not how I found the hidden parameter.\
When we order an item we can try to add a discount code in the dedicated field. This sends a post parameter `discount` we can try to use it as a GET method in the url and see if it is injectable like this `http://nahamstore.thm/product?discount=<script>alert(1)</script>`.\
And it works!

![Discount parameter](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-3a2e880c05d46c6422443205b9b2f7812d89281c%2F2023-06-26-09-44-14.png?alt=media)

## Open Redirect

### Parameter 1

This one was found using the previous results I got from arjun\
The parameter r can produce and Open Redirect.\
If we use burp collaborator to generate and url and we paste it in the parameter like this `http://nahamstore.thm/?r=https://ccswimp6q43ue36mhiqkujheh5nwbmzb.oastify.com` we get redirected.\
If we open this link and a private tab (or another firefpx container) it works as well.\
This proves it is vulnerable.

> Note: We do not have to use the collaborator we can paste in any website

### Parameter 2

As I browsed a lot in the website I had a pretty decently populated sitemap. I filtered it to show only redirections and found the `redirect_url` that is the other parameter vulnerable to open redirection.\
Now we can look it up in our proxy history and see where it is used to try and exploit it.\
We can see that it is used after the registering and after adding a new address. Let's connect and try to exploit after adding an address to our address book.\
Let's do the whole workflow.

* We make an account on the shop
* We put something in the basket
* We add a new address
* After validating the form the process is to redirect the user to the basket. This way we can use the parameter and modify the request to change the redirection location.

\=> **Original request**

![redirected](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-56a3b8edc2bdb09434f7b4d6b89cc9ce7eb07ef7%2F2023-06-26-13-56-14.png?alt=media)

\=> **Modified request**

![modified](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-47bc7bb2ed6697c4af53b95efa9fd63e28813cb0%2F2023-06-26-13-58-46.png?alt=media)

\=> **Response making the redirection**

![Response](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-083e2a9a66cbe7dcd524fd884a23034356920245%2F2023-06-26-14-00-13.png?alt=media)

## CSRF

Using burp to show the hidden fields we can quickly see which page has a csrf protection or not.

* Email page with csrf protection

![csrf protected email](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-441bed50308ca5a72dfd0f5315f0ccaa7c36a08b%2F2023-06-26-14-07-58.png?alt=media)

* Password page without csrf protection

![not csrf protected password](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-6c034882b95a6bca1484e99af09ec1fe2160aaac%2F2023-06-26-14-08-43.png?alt=media)

### csrf\_protect token analysis

With further analysis we can see that the token is using base64

* Orignal token `eyJkYXRhIjoiZXlKMWMyVnlYMmxrSWpvMExDSjBhVzFsYzNSaGJYQWlPaUl4TmpnM09EQXlPVGc0SW4wPSIsInNpZ25hdHVyZSI6ImE2NjNmZWIyYTcxNGYzZDA5Njc2OGYyNDNmNjY4YWUwIn0=`
* Decoded token `{"data":"eyJ1c2VyX2lkIjo0LCJ0aW1lc3RhbXAiOiIxNjg3ODAyOTg4In0=","signature":"a663feb2a714f3d096768f243f668ae0"}`
* Decoded data parameter `{"user_id":4,"timestamp":"1687802988"}`

### Exploitation

#### Password field

We can use burp to generate a csrf poc for us from the request to change the password. We can right click on it and select generate csrf poc in engagement tools.\
![csrf](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-49c2c2ff6b28b8cd302e08f324f402d074edf3f1%2F2023-06-29-13-43-07.png?alt=media) We copy the html and paste it in a file. Now we can open it in our browser, send the request and see if our attack worked.

![poc](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-6009187fb21f5c20490a30af80379c06c5e3597d%2F2023-06-29-13-45-30.png?alt=media)

Our attack worked

![pass changed](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-eb8d938ef56522674cfb6cae58c46a7925e06641%2F2023-06-29-13-46-20.png?alt=media)

#### Email field

For the email field we can process the same way we just need to remove the csrf\_protect hidden field that is not used anyway by the app as we can see here in burp repeater. We were able to change the password without the csrf token.

![csrf protect](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-83f1f6e4000cf4f31aea05f59217e288fefb3d7b%2F2023-06-29-14-05-15.png?alt=media)

## IDOR

### Address

We can see that the orders are fetch with an id like this `/account/orders/4`\
Let's check other orders Using the post request to validate an order we have an address\_id field that we can tamper with to get other peeps address.

![field address](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-c94db510579558b8ff0caceb7f75743677596bbb%2F2023-06-29-15-02-03.png?alt=media)

If we put 1 we get the address of another customer

![other customer address](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-8965bc7fe5e2c7ac6794f62bfa3f6260be17703f%2F2023-06-29-15-02-53.png?alt=media)

To answer the question we can play with the parameter until we find the address in NY.

### Orders

If we get the pdf receipt of an order it will use an endpoint pdf generator. The request will look like this

![request](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-a94b7a7cb78293fd60adf7449b4aa53f5222f605%2F2023-06-29-15-21-47.png?alt=media)

However here we get a pdf that says the order does not belong to us and it mentions something that could be a parameter.\
![user\_id](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-5af08b4e9ff528b457916151a1507f5070994957%2F2023-06-29-15-24-20.png?alt=media)\
We could try to add user\_id in our request. We need to do this lively (not with repeater). user\_id 1 and 2 do not work. We are successful with 3. I struggled a little and figured that it need to be url encoded otherwise it would not work.\
Like this:

![encoded parameter](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-2ef77617344b4e88347f2bb59a4f54154cfeb5e2%2F2023-06-29-15-28-17.png?alt=media)

## LFI

When I see and image on a website I always use the open image in new tab to see what we can do and play around with it. Here we can see that the image is fetched using a parameter `file=`.

![file](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-2388f6364fca5e1cb53663ee550a345414428b21%2F2023-06-29-15-37-21.png?alt=media)

We can try the usual payloads they mention the file path `/lfi/flag.txt` first I tried the usual dir traversal with ../ but it did not work, sometimes if you double the chars you can bypass the filters. that is how I got the file. You have to try one dir at a time until you find at which you level you need to go up to to find it.\
Here's what worked for this context\
![lfi](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-54bc707bf040be2e2a3357b8ef6bc965eaa4e123%2F2023-06-29-15-39-45.png?alt=media)

## SSRF

When looking around the app, we can see that if we click on the check stock for an item it actually requests a server.

![stock check](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-662ba2d26652d57fe993aff2d73e4dd92d3cd9ef%2F2023-06-29-15-49-06.png?alt=media)

### COMING SOON

![Coming soon](https://1679624655-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEkk28J0B2BeDMuesRMr1%2Fuploads%2Fgit-blob-79c94f83d11d2dcfbf46dd6e9f56209f3dcdcfc1%2F2024-07-03-16-57-38.png?alt=media)

## Resources

* [Using burp for open redirect - Portswigger](https://portswigger.net/support/using-burp-to-test-for-open-redirections)
* [Using Burp to Test for Cross-Site Request Forgery (CSRF) - Portswigger](https://portswigger.net/support/using-burp-to-test-for-cross-site-request-forgery)
* [Generate CSRF PoC - Burp](https://portswigger.net/burp/documentation/desktop/tools/engagement-tools/generate-csrf-poc)
