# Cross-Site Request Forgery (GET-based)
Navigate to `http://csrf.htb.net` and log in to the application using the credentials below:
* Email: heavycat106
* Password: rocknrol
This is an account that we created to look at the application's functionality.
Now, browse Julie Rogers' profile and click *Save*. You should see the below.
Activate burp suite's proxy (*Intercept On*) and configure your browser to go through it. Now click *Save* again.
You should see the below.
Let us simulate an attacker on the local network that sniffed the abovementioned request and wants to deface Julie Rogers' profile through a CSRF attack. Of course, they could have just performed a session hijacking attack using the sniffed session cookie.
First, create and serve the below HTML page. Save it as `notmalicious_get.html`
Code: html
```html
```
Notice that the CSRF token's value above is the same as the CSRF token's value in the captured/"sniffed" request.
You can serve the page above from your attacking machine as follows.
```shell-session
eldeim@htb[/htb]$ python -m http.server 1337
Serving HTTP on 0.0.0.0 port 1337 (http://0.0.0.0:1337/) ...
```
While still logged in as Julie Rogers, open a new tab and visit the page you are serving from your attacking machine `http://:1337/notmalicious_get.html`. You will notice that Julie Rogers' profile details will change to the ones we specified in the HTML page you are serving.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/session-security/cross-site-request-forgery-get-based.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.