-
-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Closed
Description
Sometimes you need to include some POST parameters in the request to get a CSRF token from a page.
GET parameters can be specified directly in the --csrf-url argument, but as far as I can tell, there's no way to specify POST data.
It would be very useful to be able to specify the POST data along with --csrf-method and --csrf-url, using something like --csrf-data.
Example:
sqlmap -u "http://localhost/login.php"\
--data="user=admin&pass=test&csrf_token="\
--csrf-token="csrf_token"\
--csrf-url="http://localhost/security.php"\
--csrf-data="page=login&action=get_token"