Cross-site request forgery (CSRF)
https://portswigger.net/web-security/csrf
Lab: CSRF vulnerability with no defenses
This lab's email change functionality is vulnerable to CSRF.
There is no csrf protection.
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Copy HTML
Exploit Server ->
Body:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://acd71f561e07ef5fc0553244005800ca.web-security-academy.net/my-account/change-email" method="POST">
<input type="hidden" name="email" value="test@test.com" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>Lab: CSRF where token validation depends on request method
This lab's email change functionality is vulnerable to CSRF. It attempts to block CSRF attacks, but only applies defenses to certain types of requests.
There is weak csrf protection. We can bypass it with using another type of request.
GET /my-account/change-email?email=test%40test.com&csrf= -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Copy HTML
Exploit Server ->
Lab: CSRF where token validation depends on token being present
This lab's email change functionality is vulnerable to CSRF.
There is no csrf validation.
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Copy HTML
Exploit Server ->
Lab: CSRF where token is not tied to user session
This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF attacks, but they aren't integrated into the site's session handling system.
There is weak csrf validation. It checks just legit one, not the relevant with the user.
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Replace CSRF value -> Copy HTML
We did not use intended one. We used unused csrf value.
Exploit Server ->
Lab: CSRF where token is tied to non-session cookie
This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF attacks, but they aren't fully integrated into the site's session handling system.
There is weak csrf validation. It checks just legit one, not the relevant with the user.
We obtained csrfKey and csrf value with an another user. So we can change email address with valid keys.
Obtained keys:
csrfKey=9Lz92TCDDpco7KZk7sH5s8DGsskKG9sZ; csrf value=qmTs9BViTSDgDcsP3zEJ12luELhW0VNT
We have to inject our csrfKey cookie to the user session.
In search function in website, we can see the way.
Search -> test
There is no filter for search. So we can use search func to inject our csrfKey cookie value.
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Replace CSRF value -> Replace script part as follows -> Copy HTML
Exploit Server ->
Lab: CSRF where token is duplicated in cookie
This lab's email change functionality is vulnerable to CSRF. It attempts to use the insecure "double submit" CSRF prevention technique.
There is weak csrf validation. It checks just legit one, not the relevant with the user.
Search -> test
/?search=test%0d%0aSet-Cookie:%20csrf=G2wTaO4fpWuGLL6dlBJvGBtzg7TSeDzk%0d%0aSet-Cookie:%20
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Replace script part as follows -> Copy HTML
Exploit Server ->
Lab: CSRF where Referer validation depends on header being present
This lab's email change functionality is vulnerable to CSRF. It attempts to block cross domain requests but has an insecure fallback.
There is weak csrf validation. It checks just legit referer header.
We got this error with using non-related domains at referer header: "Invalid referer header"
We deleted the referer header, then we could make the request successfully.
POST /my-account/change-email -> Engagements Tools -> CSRF PoC Generator -> Include Auto-Submit Script(checked) -> Regenerate -> Add the meta tag with contents -> Copy HTML
Exploit Server ->
Lab: CSRF with broken Referer validation
This lab's email change functionality is vulnerable to CSRF. It attempts to detect and block cross domain requests, but the detection mechanism can be bypassed.
There is weak csrf validation. It checks just legit referer header.
Referer: https://exploit-acf71f421f2374fec07372a7011e0077.web-security-academy.net/?ac3a1fd81f88743bc0a2729b00e700ad.web-security-academy.net
Exploit Server ->
Last updated