CSRF

Grab CSRF token then submit

The form is fetched, the hidden token is read from its input element, then submitted through the same session.

An anti-CSRF token is an unpredictable value that the server expects alongside a state-changing request. Its exact lifecycle is application-specific: it may be tied to a session, tied to one form, reusable for several requests, or single-use. Fetching the form and submitting through the same requests.Session preserves any cookie associated with the issued token. A token that rotates after each request must be fetched again before the next submission.

def get_csrf(s):
    r = s.get(url=LOGIN_URL, verify=False, timeout=10)
    soup = BeautifulSoup(r.text, "html.parser")
    token = soup.find("input", {"id": "csrf"})["value"]
    return token

def login(s):
    data = {
        "csrf": get_csrf(s),
        "username": USERNAME,
        "password": PASSWORD
    }
    r = s.post(url=LOGIN_URL, data=data, verify=False, timeout=10)
    if "Wrong" in r.text:
        print("[-] Login failed.")
        sys.exit(1)
    print("[+] Logged in.")

Hidden field scraped by the script

<form action="/login" method="post">
  <input type="hidden" id="csrf" name="csrf" value="b3f1c8e2">
  <input name="username">
  <input name="password" type="password">
</form>

_{Find by: csrf, token, anti-csrf, hidden input, login, bs4, beautifulsoup, fetch then post, two step · Source: PG/Monster}