Hey everyone.
This is soccer from UB degree and in this lecture we are going to continue with this.
Yes.
First of all I would request you to change the security level too low.
And let's get started.
In CSR if you will see when I change the password to anything it's just changed the password and there
is no way to validate that this request was generated by me as a user.
Many real this source
you will see that it is getting the input.
So get input password the new end password confirm right to inputs and then it updates that thing in
the database.
It simply updates that thing you will see that there is no A.C. a sort of token in this.
And that's the thing.
There is no protection at all.
So how do you exploit those kind of things when you get this request right over here.
You can copy this thing or actually you can change this password let's say PASSWORD IS EQUAL TO NEW
THIS A let's say I change it to be
and possibly confirm equals B as well.
Right.
Let us say I copied this thing and I send it to anyone.
Let us say this is a new user and he opens this speech as soon as he opens this speech.
He didn't added any password.
He did not requested any change but because this was a request his password has been changed to be you
can verify that password changed.
This is how out can be dangerous.
Let me show you how the developer tried to protect against this kind of thing on a medium security
so here.
The developer has a view that if there is someone who is going to attack the website using CSR if he
will be sending the request let's say password E and E I say change it to works.
But when you send this same request to someone else let's say this user and you press enter.
It doesn't works.
You can see request didn't look correct.
Why it doesn't works.
Let me show you this source in this case developers thinking that if their request is coming from the
same Web site then it is legit.
Otherwise it is not and that's the main thing here.
If this server as GDP Rafter is equal to this server name what this means it means that if this request
came through anything that was from this Web site local host slash TV WB to show this thing I will show
you in burp sweet it is very important or big and you should know this.
Let me open Barb's read here
and let me set the bar proxy and I hope you have till now learned how to do this I will go in settings
I will see manual proxy and Alicia OK proxy set and burps meet we go and we start a temporary project
and give it a second.
Here you go in proxy then I say intercept his own let me try to change the password intelligent we will
it actually works and I say change and here.
OK digressed and came in
and we do intercept on a Cain let's try again
and seems like we have some problem with the better.
Let's check the network settings again bought it 0 0.
Everything seems fine.
Let's click on Okay let's try to go to the Web site again because it sometimes happens.
Yes it does not working.
You can see the request is coming here I will say intercept off and I will go there first
OK.
Now let's try to intercept the traffic.
I say PASSWORD IS A and E
and I say change and let's see the request.
This is the request.
I will simply cooperate this thing
and I will open a text editor lets in not bad
and let me open a new file and this is their request.
Right.
This is do you request that works so
so request that works.
Now let's see.
Request that doesn't works.
OK let's try to grab the request.
That doesn't works.
I will simply see drop everything and
we will take the same request.
We will close all these tabs.
We don't need them
and now we will intercepted traffic and we will go right over here.
Let press enter.
So this is their request.
That doesn't work.
Right.
Let's copy this this piece did right here
OK.
And let me forward everything and set this off.
So that's all.
Now in this area you will see what's what's different.
Get host user agent except accept a separate right.
These lines you can see they are exactly the same because these lines are seam.
Let's just remove them because they are exactly the same.
And I believe I removed one more line here yes.
So you can just see the clear difference if I just remove these five lines and if I remove these five
lines here as well you will see there is an additional panel meter referent.
So here you have the reference header in the request that works.
You have the reference header in the request.
That doesn't work.
You don't have the header.
So this is the only thing that's bringing this difference.
Now for the reference header you can simply have this request on a page which is on the same website.
Let me tell you what I mean.
So I just copy this thing and let's see this ex restored okay.
Let me just say E..
And let me just add a tag here so it tag and I'll see equals
okay.
There is a limit so I remove the limit here
and I will then we'll.
This
okay.
This is my request and I see
click here.
OK.
I close my tag.
So I basically added a tag that should generate a link which is called click here and the link is going
to take the user to this modified request ISIS sign signing and now.
OK.
We don't see that.
Maybe because we are on a high level of security.
I will go in the security level.
I will change it to law.
Then I will go in the store accesses.
Let me just say E Here
let me just change this thing
OK let me sign this thing in the guest book.
We have click here button.
Let's go back to the same security medium
and let me go in the store.
So now the point which I am trying to see here is that the request doesn't works until the after header
is from the same website.
But let's say this is a chatting app or this is something like Facebook or something where you can post
links.
I added this link.
Now if someone clicks on this link because the link is on the same website different header will also
be the same.
And it will process might exist.
Let me click here and it should work.
I click here and you see password changed.
So this is how you compromised the security when developer is trying to be smart.
Right.
He's trying to validate the reference header but that doesn't helps Anyhow on the high level of security.
I want to tell you something that the developer has done a really great to work when you go here you
go ahead and see the source you will find that the developer is now checking for the A.C. is out of
token.
Let me just show you where he is doing that.
You see check token request user token and session I.D..
All right.
So here the developer has done a fabulous work.
He's taking this a sort of token and this is somewhat secured version.
There is one hypothetical situation where this can be compromised.
Let's say the Web site has another vendor ability.
Let's say the excesses stored or excesses are deflected.
Then we can use some Javascript to steal this token and then redirect the user with the token and a
new password.
But that is a hypothetical situation and you won't get that in the real world.
Right.
So having a CEO sort of token pretty much secures Stevie in an impossible level where the security is
extra secure.
You can see what the developer will do when you go here.
There is the new element which is current password so you can steal the token.
You can steal the request.
Right.
But you can not steal the correct password.
Obviously if you have the current password you can directly log in and reset the password.
You want to do all of this thing right.
And that's what makes this application super secure at this time including the current password and
the request makes it secure.
That's how she is out of work.
I'll continue this series in the next lecture till then.
Have a great day.