OK, so the next vulnerability that we're going to go over is cross site request forgery or CSR.
So Sears R.F. pretty much involves like using malicious code to take advantage of a user's trust trusted
session inside of the browser.
So an example is like a user, you know, you would maybe socially engineer a fish, a user and get
them to click on a malicious link and excuse the CSF attack so that an attack would allow the attacker
to use their current session, a.k.a. like maybe still in the cookies or something like that.
This used for their current sessions for the browser and maybe for the banking website, and then we
can use their account and wire ourselves money.
So this is a very common use case when it comes to CSR.
And if the application doesn't have the proper countermeasures in place, the application is minimal.
So let's go try this out with the vulnerable Web application.
OK, so the back of the Linux machine, let's go ahead and click CSR.
So this looks like an admin password change prompt.
OK, so there's no verification done beforehand, just this new password and then confirm new password.
So test.
So remember this second, this is maybe like an admin protected area.
So, you know, the average user probably wouldn't have access to this.
So test and then let's say test.
So it's password changed and we can actually try that out.
If you go back to the Brute Force One admin and then test and we see that it actually changes.
So this tool right here actually goes through and changes the admin password.
So knowing that it does that and we know that you are.
Oh, so let's actually see again.
So let's do like test to.
Test to.
Let's look up here at the URL, so the URL has this question mark and then it starts to give me a passing
the different attributes.
So password is a new test, too, and then password on, of course, F and then also change equals change.
So if we have all three of these in the world and like this entire URL is executed, it will change
the password to this test to right here.
So all we need to do is really, you know, create a new URL and get someone to actually click onto
it.
So the point of SRF is really just to get someone to click on a malicious link that allows you to steal
the information so or do something without their knowing or the information.
In a sense, though, we can test this out right here just to prove like that.
If we were to send somebody this like a link to this page and they would click on it because they thought
it was something else.
So say like hacked and then let's make CnF hacked as well.
So now this is password change.
If we go over the brute force admin hacks and now we logged in.
So now we know that we can pretty much get someone to execute that link would be good to go.
So now let's take this a step further and actually up the security to medium.
So we would do that by going over here to do a security.
We would go ahead and hit medium submit and then we can go back to see SRF and let's look at the source
code and see kind of like what's going on.
So this time it looks like so is doing to get requests for changing the password and still does this
like if you look at the other one is the same thing where, you know, it gets the password, new variable
gets to pass the CNF and then it does the execution.
But before this happens, it actually executes this function right here.
And this is going to check that the request is coming from the local server.
That's all of this right here is doing.
So if we were to try to change it, like from our machine, for example, let's see, like let's say
Anthony and Anthony.
There we go.
It's a good password, right?
It changed.
It won't change anything.
We don't have the confirmation that it was changed.
If I were to go over here.
I mean, Anthony using the password.
Incorrect.
So we know that didn't work.
So now we have another loop to kind of get over it.
So if you remember back what I said, it's checking to see if the referrer is like the request is originating
from the server so we can use birth to actually take advantage of this and actually, you know, change
the refer before it actually is sent over to the server.
So we can do that.
So we already have opened up so we can turn on our proxy right here.
So, Bert.
So now let's try that beautiful password, Anthony, again.
Casey Anthony, Anthony, so we have this confirmed really quick.
Let's go to Interceptor, see proxy intercept and make sure it says intercept is on.
So now let's go back over here.
We change.
It's going to swing us over to burb.
So as you can see, we're going to analyze calling this.
So this, you know, are more request that we're making.
So as you can see, this is the request that's going to be in the URL.
This is the host that is going to.
So the referrer is where we want to change.
So what we can actually do, honestly, just right here, we can just change one two seven zero zero
nine one and now is going to think that the request actually came from the local server.
You can also do that in the header section right here in to change it because I changed it.
There is a little bit cleaner a way to do it so you can do that.
And then once you do that, now is going to think that the request came from the local server.
So it must be OK.
So let's say forward, but there we go.
Oh, password change.
Cool.
So let's actually go confirm this.
I got to set up my interceptor drop.
Ten interceptor off.
Let's go back brute force, though, admin and then Anthony and hey, welcome to the password protected
area.
So now we actually know, you know, how to modify requests so we can bypass specific security measures.
And his associates are more realistically, though, we would need a social engineer.
Someone is executing something.
And one thing that we can do is actually writing a Python script.
So I'm going to pull up a script really quick that you guys can check out.
And you can if you can get someone to actually, you know, click the link and execute the script and,
you know, this would actually go ahead and change the password.
So let's look at this.
Look at that.
OK, so I'm inside a V.
I made a file called CSR Asphaug P y, and it's a very simple and short Python script that's going to
actually make the request.
So again.
So first, we import requests, as you know, from our previous Python talks or whatever kind of the
basics is what you're going to need.
If you want to make an 18th box, then we're going to have the URL in the URL right here.
We have a password unschool newest hacked password underscore.
CNN is hacked.
Change equals changed.
Those are our variables that we're passing in.
That's the world that we're making a request to.
And then the X equals request.
I get your URL cookie.
So I have this makes the HTP request and it sets the cookie.
So with all this stuff, there is a cookie that needs to be used for authentication purposes and we
set the security to medium.
So if we would actually go let's go look at that really quickly.
So if you go back into Firefox, you click the little mini bar over here and then you go to web developer
and web console so we can get the cookie.
Actually, just document dot cookie.
And then it'll give us, ah, you know, cooking for the current session, so I might actually need
to change this because it might be different than what I did before.
So I need to change that.
So I'm going to copy the session ID.
Copy that over.
Copy, and I'm going to paste it in there, so I'm going to do this really quickly.
So the cookie is going to be important for authentication so we can actually get to this page and there's
a way that we're going to go over later that we can actually capture people's cookies.
So don't worry.
Realistically, you will be able to also use this tactic.
So paste to do.
Here we go, inserts or other extra quotes.
OK, so now we did so and then we also set the headers.
So remember in burp how we had the header section.
So we want to just set the refer header to just one two seven zero zero one.
And then we put this like we can put this the the the directory path over here as well.
And then we're going to print out the response, the request.
So we have everything in here and make sure that this bracket is right here.
Let's do it right quick and let's try to do Python's SRF Stoppie, and it's going to go go ahead and
do the request.
And as you can see, is pretty much sending us the response.
So the Web page that we got back and as you can see right here, is, is password changed?
So it must have worked.
We can go ahead and try it.
So go back to the brute force page.
I mean, aniseed hacked.
Bam!
Now we know how to do a Python script there if we can get someone to execute that script.
You know, it would actually go through and change their parser without them even knowing.
And then we can go ahead and use it.
So pretty useful, pretty useful technique and was pretty, pretty neat, actually.
Be able to bypass and take advantage.
Of course I for direct.