Dashboard

Signed in as demo · email demo@ratportal.io · session cookie sess-demo

RatPortal is a normal logged-in account portal. Your session lives in a cookie that is not SameSite=Strict, so a page on another origin can make your browser fire authenticated state-changing requests. Every action in Settings, Change Email and Danger Zone is missing (or only pretends to have) a real anti-CSRF control.

How to work this lab
  1. Enumerate the state-changes — every form / link that mutates the account.
  2. Subtract the real protection — is there a token? Is it validated, session-bound, single-use? Is the method safe? Is Origin/Referer checked?
  3. Build the minimal PoC — an <img> for GET, or a self-submitting form for POST, that carries no valid token. The PoC Tester fires each shape for you.
Token robustness matrix (see Settings → change password):
Attack on the tokenCorrect server behaviourThis app
Remove the fieldrejectaccepts
Send it blank / arbitraryrejectaccepts
Reuse a spent tokenrejectaccepts
Swap in another user's tokenrejectaccepts