Account dashboard
The "Close account" control here is a link, not a form. Trigger it from an attacker page without the victim clicking anything.
Signed in as
victim
Account status
Active
How the app renders its own "Close account" control:
<a href="index.php?action=close">Close account</a>
Attacker page — paste the HTML you would host. It is loaded in the victim's logged-in browser.
This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.