Description

CSRF Allows an attacker to induce users to perform actions that they do not intend to perform.
We can find it in (Email - Password)

Impact

For example, this might be to change the email address on their account, to change their password, or to make a funds transfer. Depending on the nature of the action, the attacker might be able to gain full control over the user’s account.

CSRF POC generator

• right-click on the request and select Engagement tools / Generate CSRF PoC.
• Enable the option to include an auto-submit script and click “Regenerate”.
• You can get the request URL by right-clicking and selecting “Copy URL”.
  way:
• remove referer header and send request and check response
• remove original header and send request and check response
• remove csrf token and send request and check response
• try to change request method

  scenarios

  1- bypass CSRF token validation

• switch POST to the GET method to bypass the validation and deliver a CSRF attack
  • switch method to get
  • delete CSRF token

• Delete CSRF token

• CSRF where token is not tied to user session
  • That means u can use user’s token to another user
• CSRF where token is tied to non-session cookie
  • That means if u have sessions and csrf-key and csrf token, and as you see csrf token is different to csrfkey , so they are not generate from the same generator

the session is no tied to csrfkey, but csrf key is tied to csrf token , so if we take csrf token from another user it will not work but i we take csrf key and csrfkey from another user it will work

• CSRF where token is duplicated in cookie
  • That mean u have csrf in cookie and as a parameter , the trick here is the backend check if the csrf in cookie is equal to csrf in parameter
    

so we can put any thing similar in the both

2- Bypass Referer validation

• Remove referer header
  • if u can remove referer header so when u generate this csrf poc so you have to add “head”
    
• CSRF with broken Referer validation
  In this case compare between host and referer if referer has the host value
  
  but in this case we can abuse the referer such as: https://burpsuite/?ac741ffc1f0c0780801b…………
  in this case the request will accept it.
  csrf poc
  https://portswigger.net/web-security/csrf/lab-referer-validation-broken
  

Auto-submitting form

• first
  
• second
  
• third
  

Mitigation:

• CSRF tokens : A CSRF token is a unique, secret, and unpredictable value that is generated by the server-side application and shared
  with the client.
• Referer-based validation