---
title: "Discussion on \"CSRF + POST Body Param Reflection = POST-Based XSS (A BrainFuck)\" | Hashnode"
description: "Discussion on \"CSRF + POST Body Param Reflection = POST-Based XSS (A BrainFuck)\". Hello again,  \nThis blog explains how i chained a CSRF and XSS on a POST request. So, lets get straight into it. One day i was hunting on a private program and i could see most of hacker’s were reporting CSRF. Almost 5 reports out of 10 were them. Lo..."
url: "https://hashnode.com/posts/csrf-post-body-param-reflection-post-based-xss-a-brainfuck/672e794f59e24577388727fc"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [CSRF + POST Body Param Reflection = POST-Based XSS (A BrainFuck)](https://blog.bhuwanbhetwal.com.np/csrf-post-body-param-reflection-post-based-xss-a-brainfuck?utm_source=hashnode&utm_medium=feed)

Hello again, This blog explains how i chained a CSRF and XSS on a POST request. So, lets get straight into it. One day i was hunting on a private program and i could see most of hacker’s were reporting CSRF. Almost 5 reports out of 10 were them. Lo...

Nov 8, 2024 · 4 min read · blog.bhuwanbhetwal.com.np  
Updated Dec 25, 2024  
Read the article

-   [#xss](https://hashnode.com/tag/xss)
-   [#csrf](https://hashnode.com/tag/csrf)
-   [#bugbounty](https://hashnode.com/tag/bugbounty)
-   [#bugbountytips](https://hashnode.com/tag/bugbountytips)
-   [#knoxss](https://hashnode.com/tag/knoxss)

## Written by

[Bhuwan Bhetwal](https://hashnode.com/@ya3raj)

@ya3raj · Kathmandu, Nepal

  
[View profile](https://hashnode.com/@ya3raj)

Pentester

Hi, I’m a Penetration Tester. My job is to intentionally make applications do things they’re not supposed to—finding flaws and exploiting them to ensure they’re secure. I specialize in Web, API, Android, and iOS security.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.