So there are several types of CSR, FNB Web.
I want to do with you one more as well.
We can first have a quick look at all the types if you want, so let's log in to be Web and go to see
SRF one.
And this is a password change and we've exploited the low level.
The source of the form and we mimic the request triggered by this form.
OK, no change here to two, so here's a second example, view the page source.
As you can see, there are no extra fields to secure the form.
So now I'm going to intercept the request of this form.
And remember, to enable foxy proxy.
And burp together request.
Data transmits in the early.
And it is not so different from the example that we did with a password change form.
We just need to change the form field names.
And let it go.
B Webb also has one more CSIR, for example, so go to the CSR F3 page.
Now, this page changes the secret value of the session user.
To view the source.
OK, now see how this form has an additional hidden field.
But it really doesn't bring you any added security.
So the only thing you need to know is the longer the name of the user.
And when you refresh the page, nothing changes as well.
So I'm going to send a request to you it.
OK, the request is here in berp.
You can easily add these fields to your fake form and request.
So now you need to just enumerate users, then prepare fake forms.
And that's all.
Now go back to square one and change the level of medium.
So this is the form that once the user to fill the current password as well.
Sure, it's a good measure.
And go to see Assaraf to.
Nothing changes in a display.
But view the source.
So this time a token field is added to the form.
Now refresh the page.
By the token, value is the same.
So this is not a good implementation as well.
So when we fill the form and send the request will be, as you can see, in berp.
So this time you need to enumerate tokens or force users to use your tokens like we did in session fixation.
So let it go and go to see Assaraf three.
And view the source.
This warm also has a token feel.
And when you refresh the page.
The token changes.
OK, so fill in the input field.
And this will be the request.
So now we are going to exploit this one opened up your terminal.
Views, the SRF underscore three.
So if the level is low, it just changes the value.
But if the level is medium or high at first check, citoyen.
So then just update the secret.
And below, you can see the code that produced the token on each request.
So open up your browser again.
OK, so let me summarize a problem.
We have a form that has a hidden token field.
And this field changes her request.
Even if we create a fake form, we cannot get this value right, because the fake form will be triggered
in another tab.
So fake forms cannot reach what we're looking for in the actual form.
We can add a token field to our fake request, but we cannot add a true value.
So that means we're basically stuck here.
Now, obviously, I have a solution.
So to exploit this vulnerability, we'll just going to need another vulnerability.
Cross site scripting.
So go to X.
S.
S underscored store page, and we're going to look at this vulnerability a little later in greater detail,
but this page stores your entries and shows him just like that.
And, of course, it's vulnerable to access, so that means we can execute a JavaScript code on the
page from another source.
For example, if you add this code, you'll get an alert.
And what I want is to execute JavaScript code on my server in this page.
So I will serve this code and kaui.
It is an example, HDP request code.
Then after injecting this code into the page, it'll request a six hour F3 page.
Pass the token and then send a change request with a value that I provide.
And you can get it from here.
So now I'm going to copy it to my Web root directory.
Apache's not running so stardate.
Now it's running.
And now on the access page, I'm just going to add this line of code to inject my script into the page.
Copy and paste it.
Now, before submitting open web developer.
HDMI and JavaScript from here.
OK, now submit it.
And the alert comes from the previous code.
Quick, OK.
And below, you will see the request sent by this page.
Lo and behold, it requests my JavaScript code from my server.
After including that code in the page, my script request, CSR, a three page.
And then sends the change request containing a valid token.
OK, so now let's look to see if it changes it or not, you know, being Crome.
And as you can see, this is the old secret value.
So now refresh the page.
Browse the user's table again.
And looky here, the value has changed.
OK, so now view the page source.
And the script tags are present in the page just like that.
So we change the password without the user's knowledge.
What do you think about that?