# Cross-Site Request Forgery (CSRF or XSRF)
Navigate to `http://xss.htb.net` and log in to the application using the credentials below:
* Email: crazygorilla983
* Password: pisces
This is an account that we created to look at the functionality of the application.
Run Burp Suite as follows.
```shell-session
eldeim@htb[/htb]$ burpsuite
```
Activate burp suite's proxy (*Intercept On*) and configure your browser to go through it.
Now, click on "Save."
You should see the below.
We notice no anti-CSRF token in the update-profile request. Let's try executing a CSRF attack against our account (Ela Stienen) that will change her profile details by simply visiting another website (while logged in to the target application).
First, create and serve the below HTML page. Save it as `notmalicious.html`
```html
```
If you are wondering how we ended up with the above form, please see the image below.
We can serve the page above from our attacking machine as follows.
```shell-session
eldeim@htb[/htb]$ python -m http.server 1337
Serving HTTP on 0.0.0.0 port 1337 (http://0.0.0.0:1337/) ...
```
No need for a proxy at this time, so don't make your browser go through Burp Suite. Restore the browser's original proxy settings.
While still logged in as Ela Stienen, open a new tab and visit the page you are serving from your attacking machine `http://:1337/notmalicious.html`. You will notice that Ela Stienen's profile details will change to the ones we specified in the HTML page we are serving.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/session-security/cross-site-request-forgery-csrf-or-xsrf.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.