In this article, we will explore the concept of this security vulnerability, discussing its implications and consequences for users, as well as measures to prevent it. It's worth mentioning that to learn this technique and many others, check out our cybersecurity training platform: https://hackersec.com/academy/
What is CSRF (Cross-Site Request Forgery)?
CSRF, also known as Cross-Site Request Forgery, exploits the trust that web applications place in their authenticated users. In this type of attack, an attacker can trick a legitimate user into performing an unwanted action on a web application, taking advantage of the fact that requests sent from the user's browser automatically include authentication cookies.
How CSRF Works
To understand how CSRF works, it's essential to know the basic flow of this type of attack. The attacker creates a malicious page that contains a disguised request for a specific action on the target web application. Then, they convince the authenticated user to visit this page, often through social engineering techniques. When the user loads the malicious page, the request is automatically sent, using the authentication cookies present in the browser, causing the web application to execute the unwanted action.
Consequences of CSRF
The consequences of a CSRF attack can be diverse and harmful to both users and web applications. Some examples include altering personal information, executing unwanted financial transactions, modifying critical application settings, and even exposing confidential data.
In this example, we will use the DVWA lab, where there is a form for changing passwords.
When filling out the form and changing the password, the application sends the parameters via the GET method to effect the change.
Knowing that the application sends the parameters in the URL via GET, it's possible to create a form on a malicious page and induce an authenticated user to access the page and perform actions on the site without their awareness.
In this case, a form was created based on the source code of the password change page, where the input fields were pre-filled with values chosen by the attacker and hidden.
Through social engineering, the attacker will send the page to the target, and when the target user accesses the page, they won't realize that by clicking the 'Discount' button, their password will be changed to the one chosen by the attacker.
By clicking the “Discount” button, the password was successfully changed.
Protection Measures Against CSRF
Use of Anti-CSRF Tokens Implementing anti-CSRF tokens in forms and AJAX requests is a common practice to protect against CSRF attacks. These tokens are generated by the server and incorporated into pages or sent as headers in AJAX requests. The server validates the presence and matching of these tokens before processing requests, ensuring they are legitimate and originated from the web application itself.
Origin Verification (Same-Origin Policy) The Same-Origin Policy is a security policy implemented by browsers that restricts requests made from one site to only resources from the same domain. This helps prevent CSRF attacks by blocking malicious sites from making requests on behalf of the user to another domain.
Use of HTTP Headers HTTP headers, such as Content-Type and Referer, can be used to provide additional information that aids in protection against CSRF. For example, setting the Referer header to check if the request's origin is the same domain can help block malicious requests.
Implementation of Captchas and Two-Factor Authentication Including captchas in forms can make it harder for CSRF attacks to succeed, as it requires the user to prove they are a real human. Additionally, implementing two-factor authentication provides an extra layer of security, requiring the user to provide a second form of authentication, such as a code sent via SMS, before executing the desired action.
Validate Your Company's Security
In addition to knowing how this type of attack works and how to mitigate it, it's also worth testing your company's cybersecurity with HackerSec specialists. To learn more, check out our solutions for businesses: https://hackersec.com/empresas/
Test Yourself in Our CTF
All tests were conducted in HackerSec's CTF labs: https://hackersec.com/ctf/