Instructor: Welcome back.
In this video I want to talk about vulnerability called CSRF
or also known as cross-site request forgery.
Now this is something that you might remember
from the scanning section of the course
where we used Nmap to discover vulnerabilities.
And on one of our targets we got response
that possible CSRF vulnerability was there.
Well, the time has come
to finally see what is this vulnerability.
Many people think that this is something similar
or the same as XSS or cross-site scripting,
but that is not the case.
In cross-site request forgery,
the attacker makes the identified user
execute something that they didn't want to execute.
CSRF attack can be used to exploit any web function
that searches for one request
inside of the identified session
in case the security applied isn't efficient enough.
Some of the things that you can do
with cross-site request forgery
would be something like changing details
about a specific user like email addresses,
date when they were born and so on and so on.
You can also perform fake banking transactions,
adding items to buy on a certain page,
but this is not something that we can accomplish easily.
For this attack, we need a victim
that has active identified session inside of the website
and they will also have to visit our URL link
that we craft in order for this to work.
Now let's take a look at simple example
of how to do this on our DVWA page.
So start your metasploitable, visit the page as usual.
We want to go to the DVWA and we can log in right here.
But remember that we did the SQL injection.
We no longer have to log in as admin user.
We can log in as any other user
from the data that we extracted with our SQL injection.
So if you remember we had the user called Gordon
who had the user name of gordonb
and his password was ABC123.
If you remember that we got his MD5 hash
then we pasted it inside with the Google
and we got that his hash was equivalent
to a string of ABC123.
So we can log in as Gordon.
And we can see down here you have logged in as gordonb.
Now let's set the security to low,
and let's navigate to CSRF right here.
So we can see vulnerability:
cross-site request forgery and the application requires us
to change our admin password.
so we got the new password and confirm new password.
What we can do is we can, for example, type password123
and confirm password to be password123.
If I click on change, it says password changed
and let's see whether it indeed got changed.
So if I log in as admin and then password
remember that before it was just password,
now it is password123.
If I log in, well now it'll work.
We successfully changed the password.
But how can we use this to exploit it?
Well, if I go right click and go on view page source,
there will be a vulnerable part of code
inside of this page.
And that part of code will be the form
where we submit the new password.
If we scroll all the way down,
here is the part of the code that is vulnerable.
We got the form where we can submit the new password
where we can also reconfirm the new password.
And you will notice
that this is under the vulnerable code area.
So what we can do with CSRF is we can copy
this vulnerable form
where we submit the username and password,
and we are going to create our small HTML page
that we are going to host on our Apache2 web server.
And you're going to see in just a second why we do that.
So we'll open a terminal
and I will navigate to the directory of our web server.
And if you remember
that is /var/www/html.
Now since we can't write files right here as a regular user,
let us enter the root account.
If I type ls, we got our tester.py, we can remove it.
We no longer need it here.
And once you got this directory clear and empty,
let us nano csrf.html file.
Let's call it like that.
Now feel free to call it anything that you want.
Just make sure that you have this html extension
onto this file.
Now that we opened it, we can paste the code
that we copies from the page
and you will notice it is the form
where we change our password.
Now there are a few things
that we want to change right here.
For example, this action, we want to change to the page link
where we change our password on our DVWA.
And that page link is this link right here.
Let's copy it, let's paste it right here.
And what this action simply refers to is once we change
the password, it'll redirect us
to whatever page is inside of this action field.
So it'll just redirect us back to this page right here.
Let's copy this and paste it.
Now that we got the page right here,
there are two more things that we need to add
in order for this attack to work
and that is inside of this input fields.
So we got the name of the field, which is password_new.
I believe it is this field right here.
And the second field is confirm new password,
which is this field right here, password_confirm.
We want to automatically add value to those fields.
And in this case that value will be a new password.
So what we can do is we can type space
right after the password name
and we can type value="",
and in between the double quotes
we can type the new password.
Let's say the new password is hacked.
We must do that for the second field as well.
So value="" and then hacked.
Now you will notice once we visit this page
that in that case the fields will already be completed,
they will have this hacked value
inside of both of these fields.
Let's give it a try.
If I save this Control + O
and I start my Apache2 web server
by typing service Apache2 start,
all we need to do right now is visit our local host
and the csrf.html file, which is the only file
inside of our Apache2 web server directory.
So we got this right here.
And this is the link
that we would want to send to our victim.
Now I know it doesn't nearly look
as good as this page right here,
but let's just give it a try to see if it works.
If we did everything correctly,
once we click on this change button
on our local host CSRF file,
we will successfully change the password
of the admin account on this DVWA page.
So we send this to the target,
target clicks on change
and we get redirected
to our metasploitable DVWA CSRF page
and it says password changed.
Let's see whether it indeed got changed.
Remember we typed the value of hacked
and now if I go right here
and type admin and hacked,
well it worked, we logged in with new password
that someone typed in while visiting our page
on our local host.
But if you noticed on this page,
we only copied the form.
And if we were to host just the form code
on our Apache2 server like we are doing right now,
it would look suspicious
because if we take a look at this page and this page,
they don't look nearly the same.
So how could we make it look the same?
Well, first thing that we must do is we must go right here,
right click view page source,
and we must copy the entire HTML code and not just the form.
So what you can do is you can select the page,
type Control + A, it will select all the code
inside of this file and we can copy it.
Then we can go to our Apache web directory
and we can remove the CSRF file and we can nano new one.
Here we will paste the entire code
and remember that we must do the same thing
that we did inside of our form.
So find the form code, and here we want to put the link
to our page, which is this link once again.
Copy it, paste it right here.
We also want to add the value to our password fields.
We can change right now the password back to password
just so we put it back as it was.
And now that we did this, we can save this.
And if I go and visit a page once again
or I just reload this page,
well it looks a little bit better
but it is still not the same page,
we're missing some decoration that this page has.
And if you have some experience in web development,
you will know that we are missing the CSS file.
So what we can do to add the CSS file is we can go
to this page source of our page that we got open
and we can navigate to the CSS file.
So just search for any file type that ends with .css.
And if I go up here, here is one of them
and it is called main.css.
And by looking at this page,
it seems that this is the only CSS file that this page has.
So let's click on that.
And here is the CSS code that we also must save
in the same directory as our HTML file.
So let's select everything copy this,
and let's go back to our web directory.
Right here we are going to nano main.css
and let's just paste all of this code.
Now that we have the CSS code right here, we can save this
but it'll still not work
if we don't change the file location inside of our code.
Because if you take a look at right here
where we add the CSS file,
it is still the location on our metasploitable machine.
And since we have it in the same directory as our html file
on our Apache2 web server,
what we can do is we can just remove the entire path
and leave just the name of the file
because they're both located in the same directory.
So we can just leave it like this, then we can save this.
And now if we refresh our local host page,
well, now it looks the same, just this page isn't zoomed in.
So what we can do is we can zoom this in
and they look exactly the same.
So the password is, remember right now just password.
And if we click on change,
it'll redirect us to the real page
and it'll say the password has changed.
Let's give it a try once again
and see whether it indeed got changed.
So I will just go to my DVWA page, log out,
and type admin and then password.
And we did it again
just this time we made our page look exactly the same
as we can see right here.
Great, this is the CSRF attack
or cross-site request forger attack.
As you can see, it requires to open our link,
otherwise this will not work.
But if you manage to trick them
by making the page look identical,
then this attack will work
and you will successfully change their password.
Now this can be performed on other stuff
and not just the password fields as we remembered.
You can use this to change emails,
to change dates, and many other things as well.
Now that we covered this,
in the next video we are going to cover brute force attack,
and we are going to see
how we can perform the brute force attack
in two different ways.
So thank you for watching
and I will see you in the next lecture.
Bye.