checking referer will work 99% and without cluttering your urls.
absolutely not. Just forge the referrer header.
CSRF Tool
11–20 of 30 posts
Re: CSRF Tool
#12Hmmmm, while I'm a big fan of the OP I don't think this is really a security flaw. I'm praying to God that Facebook doesn't use CSRF as their only stop gap measure against malicious POST requests, and if that were the case then OP might have a point, but in my opinion CSRF is more of a buffer that helps prevent scale-able automated form submissions. If I understand it correctly, OP demonstrates that a simple curl can…
Cross-site request forgery prevention is all about cross-domain browser security policy.
A CSRF attack looks something like this:
1. Victim visits Evil.com.
2. Evil.com auto-submits a form to http://www.ExampleBank.com/transfer-money with parameters {"recipient": "attacker's account ID", "amount": 1000000}
3. If ExampleBank.com fails to prevent CSRF attacks, the user will unwittingly transfer $1 million to the attacker.
The technique described in the article would successfully block this attack:
1. Victim visits Evil.com.
2. Evil.com auto-submits a form to http://www.ExampleBank.com/transfer-money with parameters {"recipient": "attacker's account ID", "amount": 1000000}
3. ExampleBank.com observes that request doesn't contain a correct token parameter, so rejects the request.
Evil.com could not fetch the token themselves by curl or any other means: the token is tied to the user's account, so Evil.com would have to send the request on the client-side in order to send the request with the user's cookies. And, since Evil.com is not ExampleBank.com, the request would successfully send but cross-domain security policy would prevent Evil.com from reading the response. Therefore, only ExampleBank.com can access the token, so only ExampleBank.com can send authorized requests.
Re: CSRF Tool
#13checking referer will work 99% and without cluttering your urls.
ridiculous, say forging again, i double dare you.
how you ninjas going to do that? flash 10 was released 2008.
thanks for down voting, single mind hn as usual.
Re: CSRF Tool
#14Hmmmm, while I'm a big fan of the OP I don't think this is really a security flaw. I'm praying to God that Facebook doesn't use CSRF as their only stop gap measure against malicious POST requests, and if that were the case then OP might have a point, but in my opinion CSRF is more of a buffer that helps prevent scale-able automated form submissions. If I understand it correctly, OP demonstrates that a simple curl can…
Hey, thanks for warm words. This post is not about vulns, it's about a tool I created to find vulns. :)
Re: CSRF Tool
#15Extra points for incorporating a rap video into a technical security blog post.
Dat's how we roll, homie
Re: CSRF Tool
#16Extra points for incorporating a rap video into a technical security blog post.
[deleted]
Re: CSRF Tool
#17Maybe you should do something other than alert() the CSRF exploit, I can't copy it under Windows
hmm, maybe a popup with text area. feel free to Pull request
Re: CSRF Tool
#18Your mitigation is wrong. You need a one way function around the cookie, otherwise that can be forged too.
If a blind attacker can't predict the token, and the token is reliably checked on form submission, it mitigates CSRF.
further more: this is one and the only proper protection.
Referer: not reliable, proxies omit it Origin: not supported yet Additional header: could be tricked with Flash vuln
Re: CSRF Tool
#19checking referer will work 99% and without cluttering your urls.
Noooooooo
Re: CSRF Tool
#20checking referer will work 99% and without cluttering your urls.
ridiculous, say forging again, i double dare you. how you ninjas going to do that? flash 10 was released 2008. thanks for down voting, single mind hn as usual.
i don't downvote, but referer never been a good protection. never