Scribd
Upload
8 views9 pages

Understanding Cross-Site Request Forgery

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
8 views9 pages

Understanding Cross-Site Request Forgery

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 9

CSRF

Introduction
⚫ Understanding the CSRF Vulnerability
⚫ Methodology
⚫ Impact
⚫ Mitigations
Pre-Requirements
⚫Cookies:- Cookies are arbitrary pieces of data, usually
chosen and first sent by the web server, and stored on
the client computer by the web browser
⚫Session ID :-session ID or session token is a piece of
data that is used in network communications to
identify a session, a series of related message
exchanges. Session identifiers become necessary in
cases where the communications infrastructure uses a
stateless protocol such as HTTP.
⚫SOP(Same-Origin Policy) :-In this policy, a web
browser permits scripts contained in a first web page to
access data in a second web page, but only if both web
pages have the same origin.
What is CSRF?
⚫Cross-Site Request Forgery (CSRF) is an attack that
forces an end user to execute unwanted actions on a
web application in which they’re currently
authenticated.(owasp)
⚫It allows an attacker to partly circumvent the same
origin policy, which is designed to prevent different
websites from interfering with each other.
CSRF Attacks
⚫CSRF is stand for Cross-Site Request Forgery.
⚫In a successful CSRF attack, the attacker causes the
victim user to carry out an action unintentionally.
How CSRF work?
⚫Related action

⚫Cookie-based session handling.

⚫No unpredictable request parameters.


Impact of CSRF
⚫After Successful CSRF attack, the user carry out an
malicious action behalf of attacker.
⚫While Changing the victim’s email address or
password.
⚫While Purchasing anything.
⚫Making a bank transaction.
⚫Explicitly logging out the user from his account
Mitigations
⚫Anti-CSRF tokens
⚫Same-Site cookies attributes
⚫Dont use GET requests for state-changing operations.
⚫CSP(Content Security Policies)
⚫Source Origin and One time Token

You might also like