Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
0
votes
0answers
64 views

Using XSS to Steal Cookies WITHOUT access to external server [closed]

I'm working on a project where we need to craft an HTML page that launches a CSRF attack that logs in to an attacker account on a victim computer. The biggest hurdle however is an authorization cookie ...
0
votes
0answers
29 views

Difference between csrf and csrfkey

I came across these two parameters in Http header named, csrf and csrfkey.. Can anybody define the difference between them?
1
vote
0answers
33 views

CSRF Mitigation With Cookie Same-Site

wanted to get some advise in our OAuth process of getting token from 3rd party. Any comment would be appreciated! User click a short link and rediredirected to original link https://webssite.com/...
0
votes
1answer
94 views

For anti-CSRF, isn't a session id cookie in a hidden form field easier than a random token?

I sometimes run into sites with CSRF bugs and I want to know the simplest way to recommend for the developer to fix it. (i.e., if I tell them "Switch to a framework that has anti-CSRF protection", ...
0
votes
0answers
42 views

Why SetCookie's SameSite directive applies the destination rather than the origin?

I understand that the SameSite directive tries to protect against cross-origin leakages and CSRFs (see OWASP), but I don't get why (on my browser at least) it applies to the cookie's destination ...
1
vote
1answer
49 views

If an application has an XSS vulnerabilty, can we bypass CSRF with referer header?

Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating ...
0
votes
0answers
55 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
1
vote
1answer
68 views

Same origin policy for CSRF attack?

Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a ...
11
votes
3answers
1k views

For SameSite cookie with subdomains what are considered the same site?

For the samesite cookie attribute I'm not clear on if I set a cookie with domain .example.com from sub.example.com with the samesite attribute, if it will be considered the same site as other.example....
-3
votes
1answer
102 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
2
votes
1answer
90 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0
votes
0answers
60 views

Custom header to avoid CSRF attacks? header without token

I found that a website protects itself of CSRF attacks by validating the POST request contains a specific header: -Example-header: GF What i find strange is that this header doesn't have a csrf ...
2
votes
0answers
51 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
0
votes
1answer
87 views

Clarification of relationship between CORS and CSRF [closed]

To summarize: CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by ...
3
votes
1answer
95 views

Perform CSRF attack when CSRF token is sent in custom request header? [duplicate]

I have found that the web application uses a weak algorithm to generate CSRF token. The CSRF token is sent in a request header: X-CSRF-TOKEN: "token-string" Since the request header is being used, ...
2
votes
0answers
41 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
0
votes
0answers
60 views

Spring Security Stateless CSRF implementation in Logout

I have implemented a StatelessFilter which checks the CSRF token in the Cookie and in the headers. package com.leadwinner.sms.config.filters; import java.io.IOException; import java.util.ArrayList; ...
0
votes
1answer
205 views

Is the double submit cookie pattern still effective?

I ran across this OWASP paper and was frankly confused. I thought this pattern was still one of the cornerstone strategies against CSRF but the paper seems to say it's broken. Should this pattern ...
1
vote
1answer
235 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
0
votes
0answers
362 views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
0
votes
1answer
131 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
1
vote
1answer
54 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...
2
votes
1answer
107 views

Double submit cookie: CSRF token doesn't need be a random value?

Note: I have read the answer to this question, but found it unsatisfactory, probably because I don't understand enough about security. I'm referring to a frontend server-side rendered SPA + a backend ...
0
votes
0answers
66 views

XSSI, CSRF attackin REST API's POST method

I'm on a course and there is a bank application which I need to attack by getting users visit my site which instantly transfers X amount of money to my balance. Their transaction form posts the ...
1
vote
1answer
71 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
0
votes
0answers
61 views

Bruteforce directory with Burp : 2 parameters used in 3 step macro for intruder

I try to bruteforce paths with Burp intruder but to do so I have to be authenticated and have a valid CSRF token (transmitted as a GET parameter). So what I want to do is : Call the login page to ...
1
vote
1answer
40 views

Is a CSRF required if no direct state change operations are performed?

I'm currently developing a webservice that sits in between other webservices. In the process of securing this webservice I've gotten a bit stuck on whether or not we neeed to require a CSRF token on ...
1
vote
1answer
128 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
2
votes
2answers
112 views

CSRF Clarification and Demystification

I understand how Cross-Site Request forgery happens, but I'm very unclear about how to protect against it using a SPA(React) application. For instance, my current strategy is to, on login, send a ...
1
vote
1answer
96 views

Who can access the X-CSRF token?

I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do: http ...
1
vote
1answer
174 views

Difficulty understanding SOP and CSRF

As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
0
votes
1answer
81 views

Why can't we use a third party website to make a csrf attack?

First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors. I understand that by having a csrf token as a ...
0
votes
0answers
45 views

Pre-flight request is triggering in Chrome but not in IE

I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
0
votes
1answer
45 views

Can an attacker see Cookie Contents via CSRF attack?

I'm trying to learn about CSRF Attack and having a hard time understanding that. My understanding is, An attacker can maliciously make a request to the user via hidden value in his website to make a ...
0
votes
0answers
123 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
0
votes
2answers
98 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
0
votes
0answers
147 views

CSS injection: Extract CSRF-token by using inline-css injection

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.) <p ...
0
votes
2answers
151 views

CSRF on inter-app communication iOS

How can I make a request from one app to another on iOS and verify the origin of the app request? Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
1
vote
1answer
119 views

Exploit for a CSRF to a POST server with specific “Accept” header?

Say the attacker owns a domain, attacker.com. Attacker wants to create a webpage on it to make a CSRF attack toward the victim.com server. The targeted page is victim.com/target.php which only accepts ...
0
votes
2answers
121 views

Is acquiring the csrftoken alone sufficient for performing any security exploits?

I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
0
votes
1answer
103 views

Is it possible to exfiltrate a router config file to server using csrf ajax?

the curl commend used to download the file curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
2
votes
1answer
103 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
64 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
0
votes
1answer
64 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
0
votes
0answers
61 views

CSRF Protection for JSON RPC interfaces

I am wondering about ways to mitigate CSRF attack against JSON RPC interfaces that 1) adhere to best practices and 2) do not restrict the usability of the JSON RPC interface. For example, one ...
-1
votes
1answer
91 views

Javascript with HTML for CSRF [closed]

<html> <h1>POC CSRF</h1> <form> Enter bWAPP Password:<input type="password" id="password" placeholder="password"> </form> ...
1
vote
0answers
215 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
0
votes
1answer
94 views

Is there a way to post directly to the server without going client side?

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to ...
5
votes
2answers
759 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
1
vote
1answer
203 views

Anti-CSRF scanner still alerts after adding _csrf token to login form

I am working on a Spring MVC project. I applied CSRF Token to login form by enabling and using in Spring security. When I go to the login page, I can see that a CSRF Token generated automatically ...

1 2 3 4 5 12