Nullbyte.Org.IL :: Cross Site Request Forgery [ CSRF ]

Cross Site Request Forgery [ CSRF ]

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
*                 CSRF Attack
*
* @author: Pr0xy
* @date   : 27/09/2009(d/m/Y)
*
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

With CSRF attack we can to send a fake request from the browser of the user, and thus enter to site with the permission of the user and maintain interact with the site like the script is the user himself.

A great example of using on CSRF, is bank site after the user connects to site created cookies on his computer(Role of the cookies is save the data). 
From this moment any action performed from the user browser approved by the site system. Here comes in the AJAX technology, with the AJAX we can to send request(packet request) performed by the browser itself.
This means all the cookies and sessions of the user sent with the request(Unlike server-side language) So if there is a form that is used on bank site to money transfer. 
We can send POST request to a form using AJAX and the request is approved by the site system, because all the cookies of the user browser sent with the AJAX request

Example for CSRF exploit

html:
--------------------------------------------------------------------------   
<form action="" method="post" name="transfer">
	Amount of money to transfer:

For bank account:

<label>
		<input type="text" name="Baccount" id="Baccount" />
	</label>
	<p>
	<label>
		<input type="submit" name="send" id="send" value="Submit" />
	</label>
	</p>
</form>
--------------------------------------------------------------------------

php:
-------------------------------------------------------------------------- 
<?php
	if(isset($_POST['send'])
	{
		if(is_numeric($_COOKIE['id'] && isset($_COOKIE['password'])
		{
			if(..)
			{
				//if is valid cookies
				//transfer
			}
			else
			{
				//if is invalid cookies
				//blocking
			}
		}
	}
?>
--------------------------------------------------------------------------

What's the risk here?, as you can see the php script check if it's valid cookies and without additional filtering operation approved the transfer. 
This means that if we have the cookies we need only to send fake request to system with the cookies of the user and the system is approved the transfer.

AJAX:
-------------------------------------------------------------------------- 
<script type="text/javascript">

As already explained, requests sent AJAX are sent from the browser itself so we do not have to worry about to get the cookies of the user. 
So even though we sent only the POST in the request sent to the server you'll see something like this:

POST /file.php HTTP/1.1 \r\n
Host: www.serverAddress.com \r\n
Cookie: id=...; password=..; \r\n
Connection: Close \r\n
Content-Type: application/x-www-form-urlencoded \r\n
Content-Length: .... \r\n\r\n
money=100&Baccount=0123456789&send=Submit

Once returned from the server 200(request was received successfully) transferred $100 from the user account to account number 0123456789.
And so the CSRF attack works, Good bye...

Pr0xY

Back