Cross Site Request Forgery Vulnerabilities
Download as PPT, PDF0 likes1,721 views
The document summarizes a meeting agenda about cross-site request forgery (CSRF). The agenda includes discussing CSRF's placement in the OWASP Top 10, describing the CSRF threat and impact, explaining how CSRF works, providing a threat scenario example, discussing CSRF attack vectors, and covering CSRF countermeasures and testing methods.
![Cross Site Request Forgery Deep Dive In Cincinnati Chapter Meeting May 27 th , 2008 [email_address]](https://image.slidesharecdn.com/owaspcsrfmay27-1227480540081864-9/85/Cross-Site-Request-Forgery-Vulnerabilities-1-320.jpg)
![CSRF Causes The way CSRF is accomplished relies on the following facts: 1) Web browser behavior regarding the handling of session-related information such as cookies and http authentication information; 2) Knowledge of valid web application URLs on the side of the attacker; 3) Application session management relying only on information which is known by the browser; 4) Existence of HTML tags whose presence cause immediate access to an http[s] resource; for example the image tag img .](https://image.slidesharecdn.com/owaspcsrfmay27-1227480540081864-9/85/Cross-Site-Request-Forgery-Vulnerabilities-5-320.jpg)
Cross Site Request Forgery Vulnerabilities
- 1. Cross Site Request Forgery Deep Dive In Cincinnati Chapter Meeting May 27 th , 2008 [email_address]
- 2. Agenda TBD OWASP Publications OWASP Tools Demo By Blaine Wilson OWASP Cincinnati Local Chapter Final Questions
- 3. Place of CSRF in the OWASP Top 10 2007 Cross Site Scripting (XSS) Injection Flaws Insecure Remote File Include Insecure Direct Object Reference Cross Site Request Forgery (CSRF) Information Leakage and Improper Error Handling Broken Authentication and Session Management Insecure Cryptographic Storage Insecure Communications Failure to Restrict URL Access http://www.owasp.org/index.php/Top_10
- 4. Description of CSRF threat and the impact CSRF forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. An attacker may force the users of a web application to execute actions of the attackers choosing via social engineering
- 5. CSRF Causes The way CSRF is accomplished relies on the following facts: 1) Web browser behavior regarding the handling of session-related information such as cookies and http authentication information; 2) Knowledge of valid web application URLs on the side of the attacker; 3) Application session management relying only on information which is known by the browser; 4) Existence of HTML tags whose presence cause immediate access to an http[s] resource; for example the image tag img .
- 7. CSRF is a Same Origin Exploit The GET request could be originated in several different ways: by the user, who is using the actual web application; by the user, who types the URL it directly in the browser; by the user, who follows a link (external to the application) pointing to the URL.
- 10. CSRF Countermeasures: Client/User Some mitigating actions are: Logoff immediately after using a web application Do not allow your browser to save username/passwords, and do not allow sites to “remember” your login Do not use the same browser to access sensitive applications and to surf freely the Internet; if you have to do both things at the same machine, do them with separate browsers. Integrated HTML-enabled mail/browser, newsreader/browser environments pose additional risks since simply viewing a mail message or a news message might lead to the execution of an attack.
- 11. CSRF Countermeasures: Developers Add session-related information to the URL Use POST instead of GET Automatic logout mechanisms Rely on Referer headers
- 12. Black Box testing and example Llet u the URL being tested; for example, u = http:// www.example.com /action build a html page containing the http request referencing url u (specifying all relevant parameters; in case of http GET this is straightforward, while to a POST request you need to resort to some Javascript); make sure that the valid user is logged on the application; induce him into following the link pointing to the to-be-tested URL (social engineering involved if you cannot impersonate the user yourself); observe the result, i.e. check if the web server executed the request.
- 13. Gray Box testing and example Audit the application to ascertain if its session management is vulnerable. Check If session management relies only on client side values
- 14. Tools
- 15. Difference Between XSS and CSRF