In this lecture, we're going to have a look on SRF or cross-site request forgery.
These vulnerabilities allow us to force a user to do things that they don't want to do.
For example, once you log into a website, let's take Facebook, you'll be able to do certain things
to your profile so you can upload pictures, you can change your password, you can change your information,
send messages and post stuff to your wall.
Now CSR occurs when the website doesn't validate if the user actually wants to do the certain tasks,
so it doesn't check if the user actually intends to change their profile picture or to change their
password.
So if the website doesn't do that, we'll be able to program a HTML page, and if the user clicks it
or runs it, they'll be forced to carry out a certain task that we program it to do.
For example, we can get the user to to change their password without them even knowing.
Let's have an example on how this happens and it will become more clear to you.
So I have my DWI here and I'm just going to log in with my username and password, which is admin.
And I'm going to put my password.
Now if we go to the CRC tab here, you'll see that it allows us to change our our password.
So this is just like a normal control panel to a normal website.
And usually when you log into your account, one of the features that you can do is you can change your
password to a different password.
So from here I'm going to set my password to two, two, two, two, two, two, and I'll set it in
here as well.
The same password I'm going to hit enter.
And as you can see, it's telling us that the password has been changed.
So this is an example of a feature that the user can do to their account.
They can change their password if the Target website, which is DWI, doesn't check.
If the user actually wants to do this task, then we can create a page that is similar to this page,
and once the user runs that page, they'll actually change their password without them even knowing.
Now there's a number of ways to analyze the connection and analyze the information sent between the
client and the target to make that xref exploit.
I'm going to show you the easiest and most reliable way and it works regardless of the type of form,
whether it's post or get.
So with this particular one, it's actually really easy to exploit if you just send the URL right here
to the target user and then if they run it, their password will be changed.
But in more complicated ways.
Sometimes you don't see that.
Sometimes post is used.
So I'll show you the most reliable way to do this kind of attack.
So the first thing to do is right click the form that you want to hijack you.
We're going to inspect the element.
And we're going to look to at where the farm is.
So we're going to look at where is the start of the farm tag and the end of the farm tag.
I'm actually going to right click it in here inside the form.
And as you can see now we have the start of the form is in here and it ends with a slash form, forward
slash form, and you can see it right here at the end.
So this is the part of the code that we're interested in to this is the part of the code that we want
to modify and send to the target user so that when they run it, they'll actually change their password
without them knowing.
So I'm going to right click this and I'm going to edit as HTML and I'm going to copy everything inside
here.
So I'm going to do control A, control C.
And that's copied for me.
And then I'm going to go to my lift pad right here and I'm going to paste it.
And I'm going to save this and we'll call it CSV HTML.
And I'll put this in the desktop and click on Save and that's it, save.
Now if we let's just run this code at the start and see what we get.
So I have it right here on my desktop.
And I'm just going to double click it.
And as you can see, you just get a page, a normal page that asks you for a new password and to confirm
the password so you can see the form here is actually similar to the form that we want to hijack.
Now to get that page to work, we need to modify a few things.
Now you can see here we have a form right here and the action is set to a hashtag, so it actually doesn't
give a website to submit this form to.
So the first thing you want to modify is you want to give it to the website to submit this form to.
And this is going to be the same website that we're on at the moment.
So I'm going to control.
Copy this.
And I'm going to put it in here instead of the hashtag.
Now sometimes you'll actually if you're copying a form from a different website, you might actually
see a name of a file.
So you'll just see a file name.
You want to make sure you have the full URL to the to the form because if you just have a file name,
for example, if you just have index PHP, it won't know where that index PHP is it now it one, it's
on the website because it's already stored on that website.
But when we're actually taking the file like this and storing it on our local machine, you want to
make sure you have the full URL in here.
So even if you see something instead of the hash tag, if you see something like indexed or PHP or whatever,
keep that in there, but make sure you give it the full URL that comes before that page.
So this is all good.
Now, if I save this and if we run this, we'll actually be able to change the password using this form.
Now, the beautiful thing about these exploits, you can actually confirm that it works for you first
and then you can send it to the target client or to the target person.
So if we actually reset our password here, so I'm going to set the password to three, three, three.
Three, three, three.
And confirm it in here.
And then I'm going to do hit enter.
You'll see that we get a message telling us that the password has been changed and we can actually now
log out and log in with the new password.
So this is good.
Now we have a form that's actually not stored on the website, but using it we can actually go to that
website and change the password.
So this actually confirms that the Target website is vulnerable to XREF because it's not validating
that the request is coming from the website itself.
So it's not validating if the user actually wants to do that.