Naked - GET-based CSRF

notifications = on

Email notifications toggle

Turn notifications ON · Turn notifications OFF

The toggle is a plain link - a state change over GET. No token, no method restriction, so an <img> on any page flips it silently: <img src="/m05-p/naked/get-csrf/toggle?on=1">. Fire the GET (button in the PoC Tester) to mark it.

More hands-on practice → labs.hackxpert.com