CSRF: Custom Code is Always a Target!

Here is your challenge:
#FAIL I will turn Green on a successful CSRF

Objectives:

  1. Conduct a CSRF attack for the url /lab/webapp/csrf/10?ch10=3dfe45
  2. Assume the Pentester can lure the user to a website controlled by him
  3. You are allowed to use any other CSRF Challenge page to help solve this challenge
  4. Partial Code Snippet for Referer based CSRF protection:
  5. The challenge might be solvable using other techniques but only CSRF is allowed
  6. Remember to refresh this page after you think you've conducted a successful CSRF
  7. Click here to Reset Challenge if you need to!

Hints:

  1. Remember what you have learnt at Pentester Academy