I've got a great CSRF vuln. Can perform basically any action as the user with ease. But I want to automate certain tasks without redirecting the user around or them knowing what actions.

After creating an iframe in jscript via the dom, how can I create a form to POST from and submit it? I'm just unsure on how to call the submit in the iframe, from jscript inside the iframe.

- Kyran

document.forms[0].submit() ?

Naw that wouldn't work. I got it figured out. I have another problem though. Is there anyway to change/intercept the MIME type of a response with js or something? The response of my csrf is in json and opens up a file download on some browsers.

- Kyran

You can set a target frame in a form element. Create an invisible iframe and use it as target.