1. Two Virtual Machines: VM1 and VM2. VM1 is controlled by attacker Boby, VM2 is controlled by victim Alice. Boby has a web server running on VM1, the web server is called www.csrflabattacker.com. (This web server is by default running on every VM, so you need to disable the one running on Alice's VM, and change DNS settings so that Alice's VM knows how to visit this website.)

2. Task 2: Boby needs to create a web page on his web server: www.csrflabattacker.com/index.html. (This task requires you to know some basics about html)

Requirement for completion:
	2.1. On Elgg, Boby sends a message to Alice, the message should be:"you can win a free ticket to Lady Gaga's concert in Las Vegas by clicking on this link: www.csrflabattacker.com".
	2.2. Once Alice from her message inbox, clicks www.csrflabattacker.com, Boby would be automatically added into Alice's friend list on Elgg.

Attention: before move on to task 3, make a copy of the index.html file, as now you are going to change it to a different version.

3. Task 3: Boby, once again, needs to create a web page on his web server: www.csrflabattacker.com/index.html.

Requirement for completion:
	3.1. On Elgg, Boby sends a message to Alice, the message should be:"you can win a free ticket to Lady Gaga's concert in Las Vegas by clicking on this link: www.csrflabattacker.com".
	3.2. Once Alice from her message inbox, clicks www.csrflabattacker.com, Alice's profile page needs to show "Boby is my hero!"

4. Task 4: Show Jidong your changes and demonstrate the attack (both task 2 and task 3) doesn't work anymore after the change. You need to explain why it doesn't work.

Completing either task 2 or task 3 will be considered as 0.5 lab finished; completing task 2,3,4 will be considered as full lab completion.