In this will, we're going to take a look at this sort of attack and we also see the demo and see serve
as a sort of crossette request for the is also called green site called forgery.
So what in this will do is in this attack, attacker forces used to execute unwanted requests which
result in better us are posited.
Suppose the website offers to delete the account and you only can build the account so the attacker
forces you to submit that delete request.
So he does not tell you to read the request, but he will stencilling.
So if you open the link and immediately your, uh, the account will be digital because of the background
request.
So in this user open selling shelbie attacker and upon opening the request on behalf of user will be
sent to the server.
So that sends the link to the user and user thinks it's normally and will open the request and open
the link and the request will be sent on behalf of user.
So this is malicious actions like money transfer, password changing and a condition, etc..
So if the money transfer website has been using the request to get the data, then Atticus's available.
Right.
So he's the variables and creates a legitimate link and then will send to the user.
So the user normally clicks things thinking that it's a different.
So upon clicking, the request will be sent of money transfer, a conclusion, etc..
So this is the theory of what this user, FedEx, uh, generally this is not a but the attacker takes
advantage of this.
Uh, not so the same policy security mechanism.
So so let's go ahead.
And, uh, so not really transform our policy.
The controversy can be you can create a token that is, uh, sort of random, unique generation of tokens.
And then you can use that to identify whether it's coming from the ground or it's coming from a normal
request.
So let's go and see a demo.
Now, I have this multiple running and it's like this is one zero two and two.
We are going to perform on this digitally.
So the admin and type in the password.
So now what I want to do is we're going to see Caesar and here you can change the posture of the.
So this he's vulnerable to ensuring that Caesar protects.
So let's create a new password that is already set b, m, b.
So we are going to change that to them so successfully, that rogo and segment.
And so camp is working right now, minority.
My brother has been said to proxy, as you guys can see here, post request of the campaign.
And before that, let's see the request, as you guys can see here.
Yes, there you go.
So let's change again the buzzword that's nickel and.
And this time we intercept the request, let's click on Change and now we can see there is a request
and the you are a little bit vulnerable.
This is, of course, a question mark.
And the word was a possible new is question and password confirmation is was legal and just bullshitting.
So these are the three variables you need to concentrate parser parser conventions.
All right, now let's get this into a path to normal to process the request.
So what we're going to do is we are going to right click on this quick on this engagement tools and
to serve people see proof of concept to really this is only for promotionally.
So what I'm going to do is I'm just going to Google and I'm just Google for of.
SESAR people see.
So here I will this ring scores of people, 600 or know what I want to lose, I want to see the matter
that is the Red Sea.
This one can see this is a good matter, right?
So that mattered.
And then coding and coding is multipart plaintext.
So it's a plain text format and see the brain actually.
OK, so now we need to give the data.
So what data we need to do the variables data.
Let's call people here and push it in here so this will generate a normal page with a button on it.
So whenever the user clicks with the suggestion now that you are.
So you are using this one identifier.
Sollozzo.
Copy and paste it in here.
I think in order to do this variables, we can distribute like this, so let's see what my options are.
So let's do this because let's say you file.
Go downloads and you will see us Caesar's Palace open with a notepad.
So I want to just show you this.
This is just a simple form.
It's a simple form where there are this password.
So here is the password and the first one is the new password.
And second, the textbooks used for confirmation.
And you can see here that that method is supposed to get action is close to this one.
So it will go to this website and you can also submit a to simply subject.
So now what is going to do is when our users put this button submit button, then this request will
be posted on behalf of the user.
So let's go ahead and open this in Firefox.
So it has been open now we have set the password to get right on, let's go.
So let's log in again at you know, we are OK with that.
So let's open this.
So as you can see, the person is Nicole, Nicole.
OK, let's change this, Nicole to Nicole.
Nicole.
And now we need to submit this so we need we can also hide these text boxes, but it's just for simplicity.
I'm just showing you this.
And here we can keep their claim for hundred dollar reward or something like that, which makes the
user to click this submit button whenever I click this.
As you can see, the password has been changed.
But here it's normal.
As you guys can see the order it's been passed on Unical to and changes change has been executed successfully.
Let's go out and say, I know I'm going to take Nicoleta now.
Let me just trust this.
And now you guys can see it, I'm sending the nuclear adviser for this, we got the success we are all
doing successfully.
So by this, uh, right this way, you can, uh, change the password or you can also delete the account.
So one thing you can do is you can hide this using the, you know, uh, option.
So you can say helan.
So to make much sturdier.
Now, you guys can see it's normal to remove this textile so we can just keep someone like you have
won the lottery or get a chance to win in a giveaway or something.
No, you can just submit and possibly be set.
So that's all for this season.
I hope we understood.