In this lecture, we're going to have a look on CSR or cross site request forgery, these vulnerabilities
allow us to force a user to do things that they don't want to do.
For example, once you log into a website.
Let's take Facebook.
You'll be able to do certain things to your profile so you can upload pictures, you can change your
password, you can change your information, send messages and post stuff to your wall.
Now, CSR advocates want the website doesn't validate if the user actually wants to do the certain tasks.
So it doesn't check if the user actually intends to change their profile picture or to change their
password.
So if the website doesn't do that, will be able to programmer HTML page and if the user clicks it or
runs it, they'll be forced to carry out a certain task that we program it to do.
For example, we can get users to change their passwords without them even knowing.
Let's have an example on how this happens and it will become more clear to you.
So I have my divi here and I'm just going to log in with my username and password, which is admin.
And I'm going to put my password.
Now, if we go to the Sierra, stop here, you'll see that allows us to change our our password.
So this is just like a normal control panel to a normal website.
And usually when you log into your account, one of the features that you can do is you can change your
password to a different password.
So from here, I'm going to set my password to two, two, two, two to two.
And also in here as well, the same password I'm going to hit enter.
And as you can see, it's telling us that the password has been changed.
So this is an example of a feature that the user can do to their account.
They can change their password.
If the target website, which is divided, doesn't check.
If the user actually wants to do this task, then we can create a page that is similar to this page.
And once the user runs that page, they'll actually change their password without them even knowing.
Now, there's a number of ways to analyze the connection and analyze the information sent between the
client and the target to make that SRF exploit.
I'm going to show you the easiest and most reliable way.
And it works regardless of the type of form, whether it's post or get.
So with this particular one, it's actually really easy to exploit if you just send your URL right here
to the target user and then if they run it, their passwords will be changed.
But in more complicated ways, sometimes you don't see that sometimes post is used.
So I'll show you the most reliable way to do this kind of attack.
So the first thing to do is right.
Click the form that you want to hijack.
You were going to inspect the element.
And we're going to look to at where the farm is, we're going to look at where is the start of the form
tag and the end of the form tag.
I'm actually going to right click it in here inside the forum.
And as you can see now, we have the start of the forum is in here and it ends with a slash forum,
forward slash forum, and you can see it right here at the end.
So this is the part of the code that we're interested into.
This is the part of the code that we want to modify and send to the target users so that when they run
it, they'll actually change their password without them knowing.
So I'm going to right click this and I'm going to edit as HTML and I'm going to copy everything inside
here, so I'm going to do control a control see.
And that's cockpit's for me.
And then I'm going to go to my left side right here and I'm going to pasted.
And I'm going to save this and we'll call it six hour aftertaste Tmall.
And I'll put this in the desktop and click on Save, and that's it, save now if we let's just run this
code at the start and see what we get.
So I have it right here on my desktop.
And I'm just going to double click it.
And as you can see, you just get a page, a normal page that asks you for a new password and to confirm
the password so you can see the form here is actually similar to the form that we want to hijack.
Now, to get that to work, we need to modify a few things now you can see here we have a forum right
here and the action is set to a hashtag.
So it actually doesn't give a website to submit this form to.
So the first thing you want to modify is you want to give it to the website to submit this form to.
And this is going to be the same website that we're on at the moment.
So I'm going to control copy this.
And I'm going to put it in here instead of the hashtag.
Now, sometimes you'll actually, if you are copying a form from a different website, you might actually
see a name of a file.
So you'll just see a file name.
You want to make sure you have the full your URL to the to the form, because if you just have a file
name, for example, if you just have indexed that BHP, it won't know where that index is.
It now it when it's on the website because it's already started on that website.
But one, we're actually taking the file like this and storing it on our local machine.
You want to make sure you have the full URL in here.
So even if you sign something instead of the hash tag, if you see something like indexed at BHP or
whatever, keep that in there, but make sure you give it the fully URL that comes before that page.
So this is all good now if I save this and if we run, this will actually be able to change the password
using this form.
Now, the beautiful thing about these exploits, you can actually confirm that it works for you first
and then you can send it to the target client or to the target person.
So if we actually reset our password here, so I'm going to set the password two, three, three, three.
Three, three, three.
And confirm it in here.
And then I'm going to do hit enter.
You'll see that we get a message telling us that the password has been changed and we can actually now
log out and log in with the new password.
So this is good.
Now we have a form that's actually not stored on the website, but using it, we can actually go to
that website and change the password.
So this actually confirms that the target website is vulnerable to R.F. because it's not validating
that the request is coming from the website itself.
So it's not validating if the user actually wants to do that.