meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 1 month |
| seen | Feb 17 at 15:49 | |
| stats | profile views | 4 |
He is Me and I am Yu
|
Oct 4 |
awarded | Benefactor |
|
Oct 4 |
accepted | OAuth2 Cross Site Request Forgery, and state parameter |
|
Oct 2 |
comment |
OAuth2 Cross Site Request Forgery, and state parameter Thanks. I've done such XSRF (CSRF) attacks (e.g. I sent a link to my friend that made him delete a post on his forum), and I imagine an attack where someone gives you a login URL to a site, where you login as him (victim logs in on attacker's account). It's quite easy to protect against such attack (store state in session), but aren't there more complex hacking techniques than that? |
|
Sep 27 |
awarded | Promoter |
|
Sep 14 |
revised |
OAuth2 Cross Site Request Forgery, and state parameter updated link to the ietf draft to last version |
|
Sep 14 |
asked | OAuth2 Cross Site Request Forgery, and state parameter |
|
Apr 30 |
awarded | Supporter |
|
Apr 30 |
comment |
Injecting ampersand to the url With this repeated keys i was meaning a specific situation when I already set all keys that the API reads, and the API could just check if keys aren't repeated. But indeed, it looks like I can just inject everything in one key, and then put %23 (#) on end of it. It will make everything next to parse not as keys. In some situations that would bypass the multikey checking protection, and in PHP it would always made the injected params treated as most (only) important. But my current point is, how the API can protect a developer, and looks like there's no general solution. |
|
Apr 29 |
comment |
Injecting ampersand to the url I wrote that the API server could check if a key is repeated, but now I think, could the hacker inject such characters, to make real ampersand become part of the previous value, and so, making the whole key-value pair 'swallowed' by previous value? |
|
Apr 29 |
awarded | Scholar |
|
Apr 29 |
accepted | Injecting ampersand to the url |
|
Apr 29 |
comment |
Injecting ampersand to the url I can't believe it was so easy. It was probably too hot yesterday, that I didn't achieve it myself, I tried escaping the ampersand, just not with %26. I guess again, when I already knew something is possible, got it easily... Accepted! Thank you, good sir! |
|
Apr 29 |
comment |
Injecting ampersand to the url Thanks for this, I'm reading right now. As for defending, in this case it's pretty easy, as the parameter values consists only of letters and digits, but to protect other developers I think the service ('external API' in example) provider should check if some keys are repeated, and if they're different, it could just return "success:false", am I right here? |
|
Apr 28 |
awarded | Student |
|
Apr 28 |
awarded | Editor |
|
Apr 28 |
revised |
Injecting ampersand to the url just line breaks. |
|
Apr 28 |
asked | Injecting ampersand to the url |
