1

I am pentesting a web application which does not use an anti-CSRF token, but uses parameters whose names contain colons. One of the parameters is, for example, _pt1:p1:1:pc1:pageToolbar:t_id_.

When I make the HTML auto-submit page with input element like this:

<input type="hidden" name="pt1:p1:1:pc1:pageToolbar:t_id" value="1"/>

it will be sent URL encoded, so it won't be correct for the application. Does this mean that CSRF is impossible?

  • What is the original form's encoding? – Arminius Oct 22 '17 at 21:12
1

There are three different content types you can let a form send (unless you have special CORS permission):

application/x-www-form-urlencoded
multipart/form-data
text/plain

You have tried the first one, and it doesn't work. It's unlikely that the second would help you (it's just a way to stitch multiple content types together when you are uploading files). So your best bet would be the third. Try a form looking like this:

<form enctype="text/plain">
    <input type="hidden" name="use:a:colon" value="This is an attack!">
    <input type="submit">
</form>

You will be able to send requests without having the colons encoded. Wheater it actually works or not, well, thats another story. The server might not accept this content type or there may be other hurdles.

  • +1, I forgot about `text/plain. That's obviously the correct answer. – Arminius Oct 23 '17 at 12:27
0

No, that doesn't mean it's invulnerable to CSRF, just that the approach you're taking to test for CSRF is limited.

For testing, you can use a proxy like burp or Zed Attack Proxy to send the raw data you want. Or you can use curl or a browser addon like tamper data.

For an exploit, you probably can do what you need with JavaScript (though it's been a while since i played with this stuff, so you'll need to experiment). Or reverse engineer the app to figure out how it sends the data to the server, and copy that approach/code.

  • @dandavis it depends upon exactly what the goal is, and that (a) wasn't explicitlu clear in the question, and (b) is useful to future visitors. If the goal is simply to test for CSRF, then the tools are helpful. If the goal is to emulate an attack, then the other approaches I mentioned should work. – atk Oct 24 '17 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.