In the last lecture, we had a brief introduction to cross site request forgery.
We saw what is if and how it works.
And in this practical, I will show you a brief overview of cross site request forgery, practical.
Now, make sure that there is only one practical of CSR, because the higher level practicals requires
a lot of coding and mixing of two to three concepts.
At this point of view, you just need to understand what is CSR and how it works.
That is the basic working of CSR.
If so, let us go to our polyclinics machine and logging into our down vulnerable application.
So as you can see, I have logged into maasdam vulnerable web application.
Let's first go to set up and create and reset the set up.
Now, I have installed currently I installed TBWA in my machine.
You can see we do not need the metastable for this practical.
Now let us set the security level to low, because this practical is just to show you how CSR folks,
that is a proof of concept.
To understand the working conditions, go to CSR.
If the you know, the basic working of CSR, it is like a tiger sends the malicious links to user.
And when user clicks, that link attacker executes the operations which he wanted to execute.
But the user not wish to interrupt.
So now let's say I am attacker and I have changed my password.
I will give my new password as a letter, say my whole name, my mercy, and Abi and I will confirm
my password.
So in our case, Chima is the attacker and let's say Yosh is the victim, so I will change.
And yes, you can see in the euro that the new password is Jemiah and the new password is also change.
Now what I will do, I will select this and I will copy this whole request.
Right now I'm the attacker now I will go and I will start text editor.
And here I will be telling them what I want.
I want to take over of you.
I want to take over your account.
So what I will do, I will change the password here, that is.
Yes, I will change it here.
I will change it to yosh one, two, three, and I will again change the new password.
Two years, one, two, three.
No, I haven't changed the password of my own system, I'm just changing the parameters in this request.
I will copy this request.
And I will somehow send this request to you.
Now, what I will do is I will show you how can I send I will go to you are else shortener.
OK, I will just click a random first link and I will paste my original crafted link here so you can
see I will post it here and you can see new password is.
Yes.
And confirm password is yosh Al Sharpton.
And they go, I have got the new link.
I will copy this link.
And then what I will do is I will mail you saying that, hey, yo, check this cool Nike T-shirt and
it's just at 599 rupees and Youngsville, click that link, OK?
And let us see what happens now.
I will take the original link here again to show how it works.
Now.
Let us see yours, Josh has I will paste the link here now, since here when a vengeful click that link,
the link will appear like this.
And when I will hit enter, I will perform as you wish.
So I will just hit enter.
What was my password when my password was the password of durably that is password.
And whenever I hit enter you can see I have got a message password changed.
But now Yoshie surprised you.
I had actually told you that it was a Nike cool T-shirt, but yosh got an error message saying your
password has been changed now.
Oh yes.
You log out and he will just tell me that something has happened.
But here as an attacker, I am into your login page, so I will just type admin because I know your
user name, but I do not know the password.
But now, since Yosh is a victim of these R.F..
Now, since you click that link now, I will try to use the password which I changed.
The password was yosh one, two, three.
I will click login.
There you go.
I have the overview.
I have successfully hacked your account now.
Did you want to change the password?
No.
He just clicked that link and the password got reset.
This is how.
Cross site request forgery works.
The main task here is just to send the request, send a link to the victim now security expert in this
case, it was very easy because it was at low security level.
But when it comes to secure applications now, what is the flaw?
If you understand what is the flaw here?
It didn't check for the S.A.T., but when the applications are more secure than ever, I will try to
login with or whenever he or she will try to click that link.
The browser will first ask you to login that his own password and then he will execute that link.
But in our case, when you click the link, the password got changed.
This is a major flaw.
And if you want to prevent this SRF, you need to implement a set of tokens where station IDs are preserved.
So I just wanted to show you how Kesari folks and what they see as Ariff.
And that is why a cybersecurity awareness is very important.
You cannot just click random links in your email or in your text messages.
You need to be aware of what happens.
The applications like e-commerce, like Amazon, Flipkart.
If you try and do the same thing, they won't execute because there are ITCZ of tokens which check the
idea of the user who is currently logged in or wants to log in again.
So whenever he will try to execute the same link and Flipkart, Flipkart server will say, hey, this
is not matching professionality and hence I cannot allow you to execute the request.
And in this way, these are Ifill's basically implementing ambitious larrieux tokens is one of the ways
to prevent CSR.
So I hope you have gotten a brief overview of how things are works and please do not use such tools
on legal websites and as you, your IP can easily get back tracked and you can get compromised.
These videos are just for educational purposes in the next lecture.
We will see what else is that of counter measures and how to prevent against attacks using different
techniques.