Tutorial A beginner's guide to XSRF

Cosmic · 10-11-2013, 07:12 AM

Rogue: XSRF

Hello, and welcome, to my tutorial. In this guide, we'll be covering the basics of Cross site request forgery, a less commonly found method.

Introduction

XSRF (or "Cross site request forgery") is an attack that takes advantage of cookies. Cookies are small files left in your browser. Cookies are generally used to track user logins and other data.

For example.

When I input my user and pass into SL, the server is sent the information, the information is confirmed, I am logged in and a cookie is left. The cookie tells the server to keep me logged in, ensuring that I:

A) Don't have to relog on every page I visit
B) Am always logged in under the user "Rogue"

An issue with cookies, is that some sites don't clear cookies after a certain amount of time. This is a vulnerability, and how to exploit it will be demonstrated below.

Method

For this example, let's pretend I've sent Oni an email. In the email is a link to my website. Oni opens the site, sees the plaintext "I love cats", and a failed image load. He closes the page and gets on with his day.

But what Oni doesn't know, is that the cookie he left on his payment processor was not cleared, and my site executed malicious code that allowed me to steal his money!

How is this done, Rogue? I hear you ask. Let's take a look at the page source.

Code:
<!DOCTYPE html>
<html>
<body>

<h1>Cats</h1>

<p>They're cool!</p>


<img src=”http://www.bigkeshmoney.com/account/pay.php?user=rogue%22&amount=99999999 width=”0” height=”0”>

</body>
</html>

If you examine the code, in the image tags is a link. This link is not an image. When the server reads this code, it attempts to load the "invisible" image (note the width & height tags) and sends a request to that link. With Oni's account still logged in, the action is executed: and I receive all his kesh.

Thanks for reading! Drop questions below Smile