⚠ DEMO 08 — Form Action Hijacking | Authorized research only

FORM ACTION HIJACKING

RUNTIME MUTATION · CREDENTIAL THEFT

Form initially posts to legitimate endpoint. Attacker JavaScript mutates action/method before submit — credentials sent to attacker server while UI appears unchanged.

[ SUBMIT LOGIN FORM ]

🏦 SecureBank Login

action: https://legitimate-bank.com/login
[*] Form action is legitimate. Click hijack then submit.
Defense: Subresource Integrity, strict CSP script-src, form action allowlists server-side validation.