Welcome back.
In this video, I want to talk about the vulnerability called C SRF or also known as cross site request
forgery.
Now, this is something that you might remember from the scanning section of the course where we used
and map to discover vulnerabilities.
And on one of our targets, we got response that possible seats are affordability.
Was there?
Well, the time has come to finally see what is this vulnerability.
Many people think that this is something similar or the same as access or crosseyed scripting, but
that is not the case in cross site request forgery.
The attacker makes the identified user executes something that they didn't want to execute.
See, SRF attack can be used to exploit any web function that searches for one request inside of the
identified session in case the security applied isn't efficient enough.
Some of the things that you can do with cross site request forgery would be something like changing
details about the specific user, like email addresses that when they were born and so on, so on.
You can also perform fake banking transactions, adding items to buy on a certain page.
But this is not something that we can accomplish easily for this attack.
We need a victim that has active, identified session inside of the website.
And they will also have to visit our link that Rycroft in order for this to work.
Now, let's take a look at simple example of how to do this on our DV w8 page.
So start your anticipatable visit the page, as usual.
We want to go to the DV w a and we can log in right here.
But remember that we did the injection.
We no longer have to log in as admin user.
We can log in as any other user from the data that we extracted with our ESKIL injection.
See, if you remember, we had the user called Gordon who had the user name of Gordon B and his password
was A, B, C, one, two, three.
If you remember that we got his and the five hash, then we pasted it inside of the Google and we got
that.
His hash was equivalent to a string of A, B, C, one, two, three.
So we can log in as Gordon and we can see down here you have logged in as Gordon B..
Now, let's say the security Tylo.
And let's navigate to see SRF right here.
So we can see vulnerability, cross site request forgery, and the application requires us to change
our admin password, so we got a new password and confirm new password.
What we can do is we can, for example, type password one to three and confirm password to be password
one to three.
If I click on Change, it says password changed and let's see whether it indeed got changed.
So if I log in as admin and then password, remember that before it was just password, now it is password
one to three.
If I log in, well now it will work.
We successfully changed the password, but how can we use this to explain it.
Well, if I go right click and go on View page source, there will be a vulnerable part of code inside
of this page and that part of code will be the form.
Will we submit the new password?
If we scroll all the way down, here is the part of the code that is vulnerable, we got the form where
we can submit the new password, where we can also reconfirm the new password, and you will notice
that this is under the vulnerable code area.
So what we can do with our F is we can copy this vulnerable form where we submit the user name and password
and we are going to create our small HTML page that we are going to host a number of Pache to Webster.
And you're going to see in just a second why we do it.
So open a terminal and I will never get to the directory of our Web server.
And if you remember, that is w HTML.
Now, since we can't write files right here as a regular user, let us enter the root account.
If I type, unless we got our tester the API, we can remove it.
We no longer needed here.
And once you got this directory clear and empty, let us now see srf dot html file, let's call it like
that.
Now feel free to call it anything that you want.
Just make sure that you have this HDMI extension onto this file.
Now that we opened it, we can pass the code that we copied front page and you will notice it is the
form where we change our password.
Now, there are a few things that we want to change right here.
For example, this action, we want to change to the page link for we change our password on our TBWA
and that page link is this link right here.
Let's scope it, let's paste it right here and what this action simply refers to is once we change the
password, it will redirect us to whatever page is inside of this action field.
So it will just redirect us back to this page right here.
Let's this and pasted now that we got the page right here, there are two more things that we need to
add in order for this attack to work, and that is inside of these input fields.
So we got the name of the field, which is password new.
I believe it is this file right here.
And the second field is confirmed new password, which is this field right here, password confirm.
We want to automatically add value to those fields, and in this case, that value will be a new password.
So what we can do is we can type space right after the password name and we can type value equals open
double quotes.
And in between the double quotes, we can type the new password.
Let's say the new password is hacked.
We must do that for the second field as well.
So value equals opened up quotes and then hacked.
Now you will notice once we visit this page that in that case the fields will already be completed.
They will have this hacked value inside of both of these fields.
Let's give it a try.
If I save this control oh, and I start my Apache Web server by typing service Apache to start.
All we need to do right now is visit our local host and see as our effort HTML file, which is the only
file inside of our Apache to Web server directly.
So we got this right here and this is the link that we would want to send to our victim.
Now, I know it doesn't nearly look as good as this page right here, but let's just give it a try to
see if it works, if we did everything correctly.
Once we click on this change button on our local CSR file, we will successfully change the password
of the admin account on this page.
So we send this to the target target.
Click on Change.
And we get redirected to our metastable WASC SRF page and it says password change.
Let's see whether it indeed got changed.
Remember, we typed the value of hacked and now if I go right here and type admin and hacked.
Well, it worked, we logged in with new password that someone typed in while visiting our page on our
localhost, but if you noticed on this page.
We only copy the form, and if we were to choose just the form code on our Patriota server like we are
doing right now, it would look suspicious because if we take a look at this page and this page, they
don't look nearly the same.
So how can we make it look the same?
Well, first thing that we must do is we must go right here, right.
Click View page source and we must copy the entire HTML code and not just the form.
So what you can do is you can select the page type, control A, it will select all the code inside
of this file and we can copy it.
Then we can go to our Apache Web directory and we can remove the C as our file and we can Nannerl new
one here.
We will paste the entire code.
And remember that we must do the same thing that we did inside the bubble form, so find the form code
and here we want to put the link to our page, which is this link once again.
Copied, pasted right here.
We also want to add the value to our password fields.
We can change right now the password back to password, just so we put it back as it was, and now that
we did this, we can save this.
And if I go and visit the page once again or I just reload this page, well, it looks a little bit
better, but it is still not the same page.
We're missing some decoration that this page has.
And if you have some experience in Web development, you will know that we are missing the access file.
So what we can do to add the access file is we can go to this page source of our page that we got open
and we can navigate to the access file.
So just search for any file type that ends with dot c.
S.
And if I go up here, here is one of them, and it is called Main DOCSIS, and by looking at this page,
it seems that this is the only access file that this page has.
So let's click on that.
And here is the access code that we also must save in the same directory as our HTML file.
So let's select everything.
Copy this.
And let's go back to our Web directory right here, we are going to Nannerl main DOCSIS and let's just
paste all of this code now that we have the access code right here, we can save this, but it will
still not work if we don't change the location inside of our code.
Because if you take a look at right here.
Where we add the fall, it is still the location on other matters, political machine, and since we
have it in the same directory as our HTML file on our patch to Web server, what we can do is we can
just remove the entire path and leave just the name of the file because they're both located in the
same directory.
So we can just leave it like this.
Then we can save this and now if we refresh our localhost page, well, now it looks the same.
Just this page isn't so and so what we can do is we can zoom this in and they look exactly the same.
So the past for this, remember, right now, just password.
And if we click on change.
It will redirect us to the real page and it will say the password has changed.
Let's give it a try once again and see whether it indeed got changed.
I would just go to my eight page log out and type admin and then password.
And we did it again just this time, we made our page
look exactly the same as we can see right here.
Great.
This is the SRF attack or cross site request.
Forgery, attack.
As you can see, it requires to open a building, otherwise this will not work, but if you manage to
trick them by making the page look identical, then this attack will work and you will successfully
change that password.
Now, this can be performed on other stuff and not just the password fields, as we remembered.
You can use this to change emails, to change dates and many other things as well.
Now that we covered this in the next video, we're going to cover brute force attack and we're going
to see how we can perform the brute force attack in two different ways.
So thank you for watching and will see you in the next lecture by.