Questions tagged [csrf]

a cross site request forgery attack causes a visitor of a malicious website to send a request to a legit website to which he is already logged in including the session cookie.

Filter by
Sorted by
Tagged with
1
vote
1answer
66 views

Who can access the X-CSRF token?

I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do: http ...
1
vote
1answer
52 views

Difficulty understanding SOP and CSRF

As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
0
votes
0answers
34 views

How to implement and validate CSRF token in ASP.NET? [migrated]

I am using an asp.net application but I dont know how to implement and validate CSRF tokens in asp.net. I want to validate these tokens in each request. I have added this following code in Masterpage:...
0
votes
0answers
39 views

Is it possible to replace a cookie value through csrf? [closed]

I found a request that looks vulnerable to csrf but that same request need a valid cookie to work. If you sent the request with a wrong jsessionId cookie value you get a 400 bad request while if you ...
0
votes
1answer
76 views

Why can't we use a third party website to make a csrf attack?

First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors. I understand that by having a csrf token as a ...
0
votes
0answers
43 views

Pre-flight request is triggering in Chrome but not in IE

I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
0
votes
1answer
39 views

Can an attacker see Cookie Contents via CSRF attack?

I'm trying to learn about CSRF Attack and having a hard time understanding that. My understanding is, An attacker can maliciously make a request to the user via hidden value in his website to make a ...
0
votes
0answers
80 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
0
votes
2answers
71 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
0
votes
0answers
86 views

CSS injection: Extract CSRF-token by using inline-css injection

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.) <p ...
0
votes
2answers
63 views

CSRF on inter-app communication iOS

How can I make a request from one app to another on iOS and verify the origin of the app request? Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
1
vote
1answer
86 views

Exploit for a CSRF to a POST server with specific “Accept” header?

Say the attacker owns a domain, attacker.com. Attacker wants to create a webpage on it to make a CSRF attack toward the victim.com server. The targeted page is victim.com/target.php which only accepts ...
0
votes
2answers
109 views

Is acquiring the csrftoken alone sufficient for performing any security exploits?

I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
0
votes
1answer
85 views

Is it possible to exfiltrate a router config file to server using csrf ajax?

the curl commend used to download the file curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
2
votes
1answer
94 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
57 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
0
votes
1answer
48 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
0
votes
0answers
38 views

CSRF Protection for JSON RPC interfaces

I am wondering about ways to mitigate CSRF attack against JSON RPC interfaces that 1) adhere to best practices and 2) do not restrict the usability of the JSON RPC interface. For example, one ...
-1
votes
1answer
64 views

Javascript with HTML for CSRF [closed]

<html> <h1>POC CSRF</h1> <form> Enter bWAPP Password:<input type="password" id="password" placeholder="password"> </form> ...
1
vote
0answers
101 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
0
votes
1answer
92 views

Is there a way to post directly to the server without going client side?

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to ...
5
votes
2answers
390 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
1
vote
1answer
131 views

Anti-CSRF scanner still alerts after adding _csrf token to login form

I am working on a Spring MVC project. I applied CSRF Token to login form by enabling and using in Spring security. When I go to the login page, I can see that a CSRF Token generated automatically ...
0
votes
1answer
310 views

Is stealing the HTTP Basic Authenication header possible via CSRF?

Recently I've been trying to find a way to steal HTTP Basic Authentication credentials via CSRF. For example, if a site is using basic authentication is it possible for an attacker to grab the ...
1
vote
2answers
282 views

Do you have to reset CSRF token after login?

In a website that have CSRF protection done using a token added as an hidden element in forms, if a session and a token is generated before login to protect against login CSRF, should you reset the ...
1
vote
1answer
104 views

Exact difference CSRF vs. DNS Rebinding attacks

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a ...
-2
votes
1answer
72 views

Session key is the same throughout the session, can this behavior be exploited?

This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
0
votes
2answers
117 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
2
votes
1answer
170 views

Anti-CSRF mechanism in a form changing password with an old password input is it required?

What is the risk for a form changing password with an old password input that doesn't have CSRF protection? A form without an old password input, I understand the risk but if the old password input ...
2
votes
1answer
103 views

Using same CSRF token after relogin

I am testing a website and observing the following behavior while intercepting and re-sending the request using postman. CSRF token is generated for each request User logs out. Generated CSRF token ...
1
vote
2answers
188 views

Is it possible to bypass this Xss Filter?

I was creating an XSS filter for my node plugin. Is there any way to bypass it? If yes How can i prevent it? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
1
vote
1answer
133 views

Can an attacker make POST or PUT request if he knows CSRF token?

I am testing a scenario to find whether an attacker can change the victims email to the attackers by tricking the victims browser to send a POST/PUT request. In this system, the attacker needs to get ...
1
vote
1answer
87 views

Is xhr.withCredentials making POST endpoints vulnerable to CSRF?

From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
0
votes
1answer
111 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
1answer
519 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
1
vote
1answer
207 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
0
votes
1answer
36 views

CSRF protection for an email subscription website - are there any risks of having it turned off?

I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
0
votes
2answers
335 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
3
votes
2answers
490 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
1answer
72 views

How to fix CSRF vulnerability alert on a website with no user authentication, If it is caused by an external Mailchimp signup form embed

A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and ...
1
vote
0answers
252 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
0
votes
0answers
62 views

What's the attack vector for authenticated wildcard CORS origin for a public API?

I have a public API (intended to be used by third-party websites) authentication only via JWT bearer tokens (no cookie authentication). SPAs have to add the Authorization header for every API request....
1
vote
2answers
764 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
0answers
54 views

What is double submit cookie? And how it is used in the prevention of CSRF attack?

I was looking at the CSRF prevention steps and was not able to understand how the double submit cookie works?
0
votes
1answer
68 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
268 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
5
votes
1answer
1k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
0answers
213 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
1
vote
1answer
104 views

Can the attacker view the response from a CSRF attack request? [duplicate]

In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page. I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
1
vote
1answer
306 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...