Web Application Security Forum - CSRF and Session Info

CSRF prevention - AJAX, CORS (3 replies)

ethicalhack3r — Fri, 17 May 2013 15:28:28 -0500

Hi,

In this scenario the client and server are on different domains. The client uses AJAX to communicate with the server's API with the use of CORS.

My initial idea was this:

1. client sends request to server for token (give me a token!)
2. server checks origin (do we trust the client?)
3. replies with token if origin is trusted (yea, ok, send him a token)
4. client sends *real* (user initiated) request with token (add a user and here is my token)
5. server checks token and origin (is the token valid? is the client trusted?)

However, it seems to add no protection for CSRF if the origin header was removed. However, if we remove the token from the above and only rely on the origin header, this has been known to have issues too (https://docs.djangoproject.com/en/1.2/releases/1.2.5/#csrf-exception-for-ajax-requests).

How would you prevent CSRF in this situation?

Thanks,
Ryan

Explain CSRF (5 replies)

mpour — Mon, 24 Sep 2012 09:06:13 -0500

Hi,

I searched about CSRF attack,I watched many tutorial video ( all of them like each other).I can't understand the CSRF.
please guide me about CSRF.

formamil.pl javascript alert tag plus html alert tag within javascript tag (1 reply)

johndoe — Mon, 06 Feb 2012 13:51:16 -0600

hello guys i just found out by my own how to include html within javascript... a working link with vulnerable formmail is here:

http://apo rre alo s.com/cgi-sys/formmail.pl?recipient=martin@aporrealos.com&subject=1&redirect=javascript:alert%28123%29;alert%28document.write.value=%3Ch1%3EHello%20%3C/h1%3E%29;

notice URL encoding...

the original formmail javascript injection was

http://apo rr ealo s.com/cgi-sys/formmail.pl?recipient=martin@aporrealos.com&subject=1&redirect=javascript:alert(123);alert(document.write.value=

Hello

);

I used this in Firefox version 7,,,,, When i copied it here the message board system automatically encoded the tags and parenthesis.

after i injected the code i got a 302 error that looked like this:

Found

The document has moved here.
Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8e-fips-rhel5 mod_fcgid/2.3.6 Phusion_Passenger/3.0.9 mod_bwlimited/1.4 Server at aporrealos.com Port 80

123 alert box popped up and later a Hello alert boxed popped up

sslstrip why it works for me and not for gmail and rest? (3 replies)

lazer — Wed, 25 Jan 2012 13:05:41 -0600

I need help understand the dynamics of sslstrip attack against ssl certs. I'm using it test the security of a site which is in my ownership. I can successfully sniff the vicitim credentials over the internet but when the same attack happens over the in case of gmail or live msn i get no stuff back its completely static in that case.

Does it means their ssl is secure and mine is not? Like the rogue ssl cert generated by sslstrip is caught and blocked by their ssl cert security and mine is like configured in a insecure mode?

WHAT i need to do to prevent my site from such attacks.Thanks

Twitter oauth tokens now what? (2 replies)

RonPaul — Thu, 19 Jan 2012 17:14:00 -0600

so i found a site that was storing 10 twitter usernames, consumer_key, consumer_secret, oauth_token and oauth_token_secret

so i have all this information.... now what?
cam i use it to get on there twitter accounts?

CSRF tokens (1 reply)

securitysrinivas — Tue, 03 Jan 2012 03:27:18 -0600

Hi,

I know to get rid of CSRF attack we have use the CSRF tokens, but not sure about the internal working of this. What I mean is where does these tokens get created and how the transfermatrion happens from client to server and when these are validated like that.

Can some one explain how the CSRF token implemenation works with pictorial represenation.

Thanks and Regards,
Srinivas

iframe form pushing (3 replies)

Kyran — Tue, 29 May 2012 10:12:51 -0500

I've got a great CSRF vuln. Can perform basically any action as the user with ease. But I want to automate certain tasks without redirecting the user around or them knowing what actions.

After creating an iframe in jscript via the dom, how can I create a form to POST from and submit it? I'm just unsure on how to call the submit in the iframe, from jscript inside the iframe.

How bypass CSRF protections (4 replies)

the_master — Wed, 06 Jul 2011 15:16:08 -0500

Hi there,

How I can bypass CSRF protections without XSS bug.
I know about, session fixation and hijacking that through them I can to bypass the Token protection.

Any ideas?

forging subdomain referer headers (10 replies)

Albino — Wed, 08 Jun 2011 22:03:49 -0500

Does anyone know a way of forging a Referer subdomain A to subdomain B post?

I've found a site, let's call it asd.example.com where requests are blocked if the Referer header doesn't start with https://asd.example.com . However, I have XSS on anothersubdomain.example.com

Even a modern-ish flash-based solution would be better than nothing. asd.example.com has no crossdomain.xml, however.

edit/^updated info

Cpanel Password (no replies)

the_storm — Tue, 25 Jan 2011 21:16:19 -0600

Hey guys,
There is a website in which I have uploaded a phpshell with user permission and this site contains cpanel v11 I can show all files in the site .. even the files in /home/site/ Directory and I can edit, remove, and add anything because I have user permission. Now, I wanna know the password of the cpanel to completely control this site, so where is the password of the cpanel is saved?
Thank u in advance

Detecting CSRF with static analysis (13 replies)

database — Fri, 07 Jan 2011 19:54:01 -0600

Hi guys,

Im doing my master thesis at the moment in the field of static analysis. Currently Im trying to come up with ways to detect CSRF or potential CSRF. However, it seems to me that for CSRF it is inheretly impossible to detect it statically.

- Taint propagation does not work since there is nothing to taint
- Model checking is not possible
- pattern matching is implausible since there are infinite many ways to implement countermeasures against csrf

Im out of options, am i missing something or should I give up?

Any help is greatly appericiated.

Javascript SOP bypassing (1 reply)

Jean Pascal Pereira — Sun, 19 Sep 2010 16:30:13 -0500

Hi,

I'd like to work on new possibilities to bypass the same origin policy of Javascript. There has been a bug in safari before and it seemed to be pretty simple doing it this way. I'm sure there are working possibilities to break out of the SOP.

My vendors:

Mozilla Firefox
Microsoft IE 8
Google Chrome

Safari doesn't make much sense for me because I'm not a Mac user.

If anyone like to work on this together with me, feel free to say hello. If I got any vulnerabilities, I gonna post them.

Regards,

Jean Pascal Pereira

HTTP split / CRLF attack (no replies)

rickm — Tue, 01 Jun 2010 10:49:17 -0500

Hello

There is a application developed in asp/.net that was vulnerable to http split attacks. There was a input parameter sent in GET requests that was used as part of the location reader on the redirect. So, we just inserted a CRLF and we could create fake headers.

They mitigated the problem, but I'm unsure if it's really a good mitigation.

Now, it only prints on the location header until it reach a CR or LF character, so I'm unable to add more headers.

However, if I add two CRLF in sequence I see the next headers are sent and interpreted by the browser as HTML (body contents).

The input also filters <, >, ' and ".

Also, all data that I insert on this field always generate a redirect (302 HTTP code) to another webpage.

Inserting stuff like

foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-
Type:%20text/html%0d%0aContent- Length:%2019%0d%0a%0d%0atest

Doesn't work, I always get again the redirected page. Probable because this supposed headers are never sent as headers because of the input filter, if I add two CRLF they turn in body contents and appear as text.

XSS could be possible, but unhappily the filters of <, >, ' and " prevent me to exploit it. I could set the utf-7 on header and send encoded contents, but again I can't manipulate the headers.

Any idea if exploitation is possible?

alternatives to session fixation? (2 replies)

Albino — Mon, 28 Jun 2010 11:09:18 -0500

Hey.

I've got write access to cookies on a certain hypothetical application. I'm wondering if there are any attacks that can be used aside from session fixation, which isn't an option since the app generates a new session ID on login - if I change someone else's session ID to mine it just logs them in as me, which isn't terribly useful.

The contents of the cookie aren't reflected in the html anywhere I can find so I don't think XSS is an option. I'll report the vuln whether or not any major attacks can be launched with it, but a decent POC helps with getting taken seriously.

edit: It can be used for XSS by logging them into my account but the session ID has httponly set and I can't alter this so the XSS is essentially useless.

JSON help (2 replies)

zatoichi — Tue, 18 May 2010 02:01:19 -0500

Hi,

A web application is sending data in this format:

{"t":1,"p":1,"r":1,"rows":[{"i":0,"c":["n","H, C","A","5","T","n"]}]}

and i am using this code to get the JSON from my web site:

Is there anything wrong with the code or the format of JSON? I am using the following browsers to write the POC,

1. Firefox 3.6.3
2. IE 7.0.5730.13

Does these browsers allow setters/getters, please suggest a browser for running the PoC.

Authenticating a victim under an attacker's credentials (3 replies)

clayfox — Fri, 14 May 2010 09:26:10 -0500

This flaw exists in most authentication systems I see, but I've had trouble convincing people (including myself) that it's really a problem.

The attack can be just a CSRF which submits the attackers credentials to log in the victim and then redirects them to the site. Many to most authentication schemes don't have nonces in the login form.

What attacks does this allow? I see a few:
1. Getting someone to enter info that only they know (data extraction). This could involve passwords, CC numbers, SSNs, Intellectual Property, and pretty much any other data or actions involved in the application.
2. Framing someone for hacking.
3. Taking advantage of someone else's hard work (taking surveys, entering raffles, etc).

I know that there is a big issue with the victim noticing that the system is treating them like a different user, but's lets ignore that.

What do your devious minds see?

Can Referer be forged via CSRF over HTTP, or on recent browsers? (9 replies)

bimn — Thu, 29 Apr 2010 16:02:25 -0500

I wonder if I can tap the deep knowledge of this site. Consider a site that attempts to defend against CSRF by checking the Referer header.

1. If the site uses only SSL, are there any ways to bypass the Referer check? Can a Referer header be forged in a CSRF attack if all links are over HTTPS? (I know that a malicious client can send any headers it wants, but I'm talking about a CSRF attack scenario: the victim is using an ordinary browser to access a malicious website, which wants to trick the browser into visiting the target website using a forged Referer header.)

2. If user is using a recent browser, are there any ways to bypass the Referer check? I know that older versions of Flash allow spoofing Referer headers, but I'm not familiar with the current state of Referer header spoofing. Given the population of browsers out there today, are there exploits to spoof the Referer header? If not, how old a browser or how old a plugin would the user have to be using, to be vulnerable to CSRF attacks that spoof the Referer header? How many users use browsers/plugins that are that old?

Thanks for the information!

hacking ASP session state (2 replies)

bflavor2 — Thu, 18 Mar 2010 21:45:04 -0500

Hello all,

I'm doing a test against an IIS 6 box with session state enabled. Sessions are tracked completely server side by a url like such:

websitedotcom/(S(1ngoc045sslvlc45tazuhg45))/AppPages/address/changeaddress.aspx

or

websitedotcom//(S(j4nd2sjarzlj5ejved0irh2u))/apppages/changeaddress.aspx

So each time you visit the site, it's a new URL, also the session state tends to change during automated scans. Has anyone ran into this problem? Most automated tools break trying to scan or spider (Acunetix, Paros).

Any ideas on approach?

javascript hijacking (17 replies)

clayfox — Tue, 23 Mar 2010 11:07:58 -0500

In Firefox 3.5 ...

Everything I read about javascript hijacking seems to be out of date (or was always wrong). Everything is saying overwrite the Object or Array constructor, but the object and array constructors don't get executed for literal object/array syntax.

JSON: [["one","two],["a","b","c"]]

This uses four separate methods to prevent clickjacking, and there's some that I don't fully understand.

Method 1 overwrites the 'document.write' method, but I'm not sure what this prevents
Method 2 is the basic framebusting technique.
Method 3 deletes the content of the page to prevent it being clicked. This is needed in case the framing page uses some sort of anti-framebusting technique (e.g http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/)
Method 4 deletes the content of the page once it has loaded - but I'm not sure why this is needed as well as method 3.

Does anyone have any ideas on why methods 1 and 4 are required?

Is it possible to bypass 127.0.0.1 referer check? (6 replies)

acemutha — Tue, 29 Sep 2009 05:21:46 -0500

Hi as per title, I was wondering if it's possible to send a request to a remote site using 127.0.0.1 as referer header.
The question is related to the fact that the only control the application does to prevent you from changing the admin password is checking if the string 127.0.0.1 is in the referer field.

Here's the php code.

if ( eregi ( "127.0.0.1", $_SERVER['HTTP_REFERER'] ) )
[...]

Thanks in advance

Is that a robust defense to csrf by on check the referrer? (2 replies)

joel — Mon, 21 Sep 2009 07:27:13 -0500

Implementing a anti-CSRF token will be much more complex than only check the referrer header.