Oh no, was that CSRF #Ouch

OH NO, WAS THAT CSRF ?
Abhinav Sejpal

WHO AM I
I' M new Generation Exploratory Testy
Researcher & Reader in free time
Spekear at
Facilitator at Weekend Testing
Crowd Tester (AKA. Bug bounty Hunter)
Reported Security Vulnerabilities for 50+ unique customers all over the world
inlcluding Apple, yahoo, Outlook, adobe & etc.
Proficient at Functional, Usability , Accessibility & Compatibility Testing
Love to develop nasty code & Hack it :)
Works as Quality Analyst at
AKA. Bug Wrangler
Null & OWASP Co mmunity
passbrains.com

DISCLAIMER
This Presentation is intended for educational purposes only and I cannot be held liable for
any kind of damages done whatsoever to your machine, or other damages.
Please - Don't try this attack on any others system without having context knowledge or
permission, this may harm to someone directly or indirectly.
Feel free to use this presentation for practice or education purpose.
^ I hope - You gotcha ^

SOCIAL MEDIA FEED
Hashtag for this session
# , #BitzNightTesting CSRF
: Twitter handle for feedback :
@ @weekendtesting Abhinav_Sejpal
G+
http://goo.gl/kMAOs1

AGENDA
Introducation
Set up Pen Testing LAB
Overview of HTTP Request
Intercept the HTTP Request using Proxy (MITM)
Understanding cross site attacks
Testing for a cross site request forgery risk
Attack Anti-forgery Attacks
Common Defences Against CSRF

SETUP THE TEST LAB
Install XAMPP
for:Acronym
X (to be read as "cross", meaning )cross-platform
Apache HTTP Server
MySQL
PHP
Perl

Why MySQL? is Girlfriend of PHP
TARGETED APPLICATION
Client Side language : HTML & Javascript
Server side Language: PHP
DB : MYSQL
Why PHP ? - Any answer Here?
MySQL <3

http://w3techs.com/technologies/overview/programming_lang
PHP IS USED BY 82.2% OF ALL THE WEBSITES AS SERVER-SIDE
PROGRAMMING LANGUAGE.

PHP: 244M SITES
2.1M IP ADDRESSES

2013 Server-side Programming Language of the Year
Don't Mind Power of PHP > Facebook & yahoo
http://w3techs.com/blog/entry/web_technologies_of_the_year

It's a free, open source web application provided to allow
security enthusiast to pen-test and hack a web application.
V.2X developed by aka
PLAY GROUND
MUTILLIDAE
Jeremy Druin webpwnized.

OWASP A8 - CSRF
CROSS-SITE REQUEST FORGERY

Proxy (Man in the middle)
Intercept Request & Respond from client

CSRF AKA. XSRF
THE ATTACKER EXPLOITS THE TRUST A WEBSITE
HAS AGAINST A USER’S BROWSER.
Permission fakingstealing
Disruption of the normal sequence of the site

http://127.0.0.1/xampp/mutillidae/index.php?do=logout
DEMO #1
Login ID - admin
password - adminpass
HTTP GET Request

<a href=
>
: ANSWER DEMO 1:
<html>
<title> CSRF Demo 1 </title>
http://127.0.0.1/xampp/mutillidae/index.php?
do=logout
Click me </a>
</html>

Yes it's not dangerous but annoying
UNDERSTANDING
Logout page has a simple HTTP GET that required no
confirmation
Every user who visited that page would immediately be
logged out - that's CSRF in action.

SO WHAT DO YOU THINK,
IT'S ALL ABOUT CLICK ?
ssh, No!!
Would you like to write CSRF exploit without click ??

<img src=
>
CSRF GET Request with Image Tag
<html>
do=logout
</html>

HTTP REQUEST
<iframe src="
do=logout"></iframe>
         <script> var X= new Image();
                                   X.src= "
http://127.0.0.1/xampp/mutillidae/index.php?do=logout
";
</script>

<html>
<a href =
>
Click me </a>
</html>
:: SOLUTION #1 ::
page=user-poll.php&csrf-
token=&choice=nmap&initials=n&user-poll-php-submit-
button=Submit+Vote

DOES IT EASY TO CREATE CSRF HTTP REQUEST ?
No - you should try out
IronWASP
CSRF PoC Generator - Tool for automatically generating
exploits for CSRF vulnerabilities
* One Click POC *
* Hybrid automation *
thanks a ton to Lava & Jayesh

{ Post HTTP Request }
CHALLENGE #2

CHALLENGE #3
Add user with out admin knowledge

LIVE CHALLENGE
* SIGNUP DISABLED *
PLEASE USE THE USERNAME TEST AND THE
PASSWORD TEST
CSRF & XSRF
Update the user info. without their knowledge
http://testphp.vulnweb.com/userinfo.php
Copyright © 2014, Acunetix Ltd

Can we exploit this with Level #2 ?
You've been CSRF'd with static token!

~ Keep Hacking your Code ~
There is no silver bullet to stop this - Just Trust your code

POPULAR COOL FINDINGS
by AmolFacebook CSRF worth USD 5000
GOOGLE GROUPS PROFILE CSRF
Google Account display pic deletion
Facebook Account deactivation
Advance Leanings - CSRF Token Validation Fail
http://haiderm.com/csrf-token-protection-bypass-methods/

INDIAN HACKERS/INFOSEC GUYS & GROUPS YOU
SHOULD BE FOLLOWING IN TWITTER
Thank-you http://garage4hackers.com/ community

- Twitter Folks -
@ @ , @ , @
CREDITS
riyazwalikar TroyHunt yog3sharma makash
& @
Big thank You to @ , @ & you All.
anatshri
weekendtesting srinivasskc

YES - I'M DONE!
Feel free to write me at bug.wrangler at outlook.com

LICENSE AND COPYRIGHTS
https://slides.com/abhinavsejpal/weekend-testing-csrf
copyrights 2013-2014 Abhinav Sejpal
-----
( CC BY-NC-ND 3.0)
Attribution-NonCommercial-NoDerivs 3.0 Unported
Dedicated to my lovely daddy

Oh no, was that CSRF #Ouch

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (11)

Similar a Oh no, was that CSRF #Ouch

Similar a Oh no, was that CSRF #Ouch (20)

Último

Último (20)

Oh no, was that CSRF #Ouch