In this video, we are going to see what is Csrf attack and we are going to solve the low difficulty
csrf challenge in dvwa.
Csrf stands for cross-site request forgery.
It is a type of attack that occurs when a malicious website, email or blog causes a user's web browser
to perform an unwanted action on a trusted site for which the user is currently authenticated.
The tag can be used to transfer funds, change account information, or perform other malicious actions.
You should be on Kali Linux or Parrot in VMware VirtualBox or running natively on your PC.
In step one, go to settings and set the difficulty to low.
Try to change the password.
Once you click on change, you will see the notification that password has been changed.
Now focus on the URL.
You can send this to some other authenticated user in an email or by any other method.
Whenever he will click on it, his password will also be changed.
And as we have set the password, we will know the password.
The remains constant among different users.
So whoever executes it, his password gets changed.
So on your application, go to CSV module.
Here.
We can change our password.
We also have a test credentials tab where we can check whether our password is correct or wrong.
Do set the settings too low.
Go to Csrf tab again.
I try to set a new password.
And click on Change.
Don't notice the.
A new password is indicated in the URL.
Now copy this URL and send it to any other user.
Now you can amend the password as per your wish.
And whenever the other user executes this in his own browser, his password will also get changed.
We can check the change password with test credentials.
And we can see that password has been changed.
If you look at the source code, we can see that there is no sanitation being performed.
It just checks for the old password and matches the new password and the repeat password tab.
I hope you understand the concept and see you in the next lecture.