>> Hello and welcome back to the course,
Identifying Web Attacks Through Logs.
In the last video, we talked
about cross-site scripting attacks.
In this video, we will
discuss cross-site request forgery.
Let's start with the learning objectives.
The learning objectives are to review
cross-site request forgery and to
identify the attacks through log analysis.
Cross-site request forgery exploits
the trust between a web server and the user browser.
Suppose that you access your interactive bank website.
Everything goes okay; you do whatever you need to do,
but afterwards you access a malicious website.
This malicious website will try to send
a malicious command through your web browser.
Your web browser will execute the command.
This malicious command could be
a money transfer to the attacker's account.
The user won't see the request,
and this could all happen because
the bank website trusts the user's browser.
Maybe you're thinking cross-site request forgery
is the same thing as cross-site scripting.
Well, even if the name is similar,
the attack is different.
In cross-site request forgery,
the source of the attack does
not directly connect to the web server.
That's why the name is forgery.
In our lab, we have a vulnerable web application.
In this case, the vulnerability
allows for the changing of the user's password.
First, let's see the logs of a normal request.
The two first lines are the log on
in the access to the vulnerable web page.
The next line is the user changing the password.
We can see the client's IP address,
the requested file with
the password change and the referrer.
Also take a look at the time.
The next log is a malicious request.
You can see the same IP address
and another request to change the password.
Can you identify another difference
>> between the two logs?
>> One of the differences is the password.
Another difference is the referrer.
Here we don't have the referrer,
and this new password change request happened
sometime before the first request.
In summary, how do you
identify cross-site request forgery?
Well, the referrer is the best way to identify.
If you notice an unexpected referrer,
it's a good indication that something is wrong.
Another thing is different behavior from the user,
like changing or trying
to change the password many times in
a small period of time or
the same actions in a small period of time.
Post-assessment question,
Cross-Site Request Forgery attacks
only happen if the user browser is compromised.
Is this affirmation true or false?
This affirmation is false.
Most of the time the attack will happen
because the user connected to a malicious website.
For the next question,
analyze the weblog below and
identify the possible attack type.
Here you have two post methods,
both trying to login to a web page and with
more than one minute of difference
between the two requests.
Also notice that the referrer changes.
This could be a Cross-Site Request Forgery attack
using the post request.
The source of the attack is
the web page littlecutdogs.com.
Since this is a post request,
we can't see the user or the password sent by
the malicious web server that
hosts the littlecutdogs website.
Video summary. In this video,
we discussed Cross-Site Request Forgery attacks and
identified the attacks by analyzing web server logs.
For the next video, we will analyze
other sources of logs like IPS logs.