Collected research

Join a Religion Via CSRF

ha.ckers.org web application security lab

A joke turned threat model: a private religion whose only joining requirement is indicating assent could be joined by hundreds of thousands of people through image-triggered cross-site request forgery to a form on MySpace, without any of them knowing. Ends on the serious version, where a forced request gets the victim arrested in China or accused of fetching illegal material.

Record

Document

ha.ckers.org web application security lab

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2008 research round

Tags

• csrf
• abuse-of-functionality
• http
• case-study
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.