Account settings — token protected
This "Update email" form ships a per-user anti-CSRF token, so a blank forgery is rejected. The token is not shown to you (an attacker can't read the victim's page). Defeat it anyway.
Signed in as
victim
Current email on file
victim@uncrypt.io
The app's real form (the token value is server-side, shown here masked):
<form method="POST" action="index.php">
<input type="hidden" name="token" value="********************************">
<input name="email">
</form>
Attacker page — paste the HTML you would host. It runs in the victim's logged-in browser.
This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.