# ==================================================================
# Capture HTTP — espace.banquesilex.example  (banque fictive)
# Observation 1 : le champ csrf_token vaut TOUJOURS la même valeur
#   (jeton statique) quelle que soit la session.
# Observation 2 : la session est ouverte avec un cookie SameSite=None,
#   donc il accompagne même les requêtes intersite.
# Chaque virement renvoie un en-tête X-Audit-Ref (texte chiffré, en hex).
# ==================================================================

--- ouverture de session (référence) ---------------------------
GET /login HTTP/1.1
Host: espace.banquesilex.example
X-Forwarded-For: 198.51.100.88

HTTP/1.1 200 OK
Set-Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490; Path=/; Secure; HttpOnly; SameSite=None
Content-Type: text/html

--- requete #01 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.23
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253025f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #02 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=75&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253015f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":75}

--- requete #03 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7618206000210000077770456&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253005f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #04 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7618206000210000077770456&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253075f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #05 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7618206000210000077770456&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253065f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}

--- requete #06 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.41
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253055f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #07 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.23
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=120&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530253045f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":120}

--- requete #08 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.23
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630004000030000055550123&amount=60&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f51015302530b5f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":60}

--- requete #09 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=75&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f51015302530a5f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":75}

--- requete #10 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=120&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252035f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":120}

--- requete #11 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.88
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630004000030000055550123&amount=1500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252025f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":1500}

--- requete #12 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=1500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252015f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":1500}

--- requete #13 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.88
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252005f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #14 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://cadeaux-surprise.example
Referer: https://cadeaux-surprise.example/gagne.html
Sec-Fetch-Site: cross-site
X-Forwarded-For: 198.51.100.88
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7699999000300000000000001&amount=9000&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252075f5916525b75327019511243046d1b03166b564753421c1f4c1c
Content-Type: application/json

{"status":"ok","amount":9000}

--- requete #15 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=120&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252065f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":120}

--- requete #16 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7612739000300000009870987&amount=1500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252055f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":1500}

--- requete #17 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=60&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530252045f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":60}

--- requete #18 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.88
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f51015302520b5f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}

--- requete #19 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630003011000500001234567&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f51015302520a5f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}

--- requete #20 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7618206000210000077770456&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530251035f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}

--- requete #21 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.23
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630004000030000055550123&amount=500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530251025f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":500}

--- requete #22 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7630004000030000055550123&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530251015f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}

--- requete #23 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.12
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7610011000200000033343334&amount=4500&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530251005f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":4500}

--- requete #24 --------------------------------------------
POST /api/transfer HTTP/1.1
Host: espace.banquesilex.example
Origin: https://espace.banquesilex.example
Referer: https://espace.banquesilex.example/virements
Sec-Fetch-Site: same-origin
X-Forwarded-For: 198.51.100.57
Cookie: session=9f3ac2e1b7d04a6f8c25e0ab13d7f490
Content-Type: application/x-www-form-urlencoded

to=FR7618206000210000077770456&amount=240&csrf_token=a1b2c3d4e5f6a1b2

HTTP/1.1 200 OK
X-Audit-Ref: 0044065b170912065e5a0d0d1354040f5101530251075f5916525b4213500c410754101f0c584a1a4b1b48184f1f4c1c
Content-Type: application/json

{"status":"ok","amount":240}