<summary><strong>Learn AWS hacking from zero to hero with</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
**Cross-Site Request Forgery (CSRF)** is a type of security vulnerability found in web applications. It enables attackers to perform actions on behalf of unsuspecting users by exploiting their authenticated sessions. The attack is executed when a user, who is logged into a victim's platform, visits a malicious site. This site then triggers requests to the victim's account through methods like executing JavaScript, submitting forms, or fetching images.
1.**Identify a Valuable Action**: The attacker needs to find an action worth exploiting, such as changing the user's password, email, or elevating privileges.
2.**Session Management**: The user's session should be managed solely through cookies or the HTTP Basic Authentication header, as other headers cannot be manipulated for this purpose.
3.**Absence of Unpredictable Parameters**: The request should not contain unpredictable parameters, as they can prevent the attack.
* [**SameSite cookies**](hacking-with-cookies/#samesite): This attribute prevents the browser from sending cookies along with cross-site requests. [More about SameSite cookies](hacking-with-cookies/#samesite).
* [**Cross-origin resource sharing**](cors-bypass.md): The CORS policy of the victim site can influence the feasibility of the attack, especially if the attack requires reading the response from the victim site. [Learn about CORS bypass](cors-bypass.md).
* **User Verification**: Prompting for the user's password or solving a captcha can confirm the user's intent.
* **Checking Referrer or Origin Headers**: Validating these headers can help ensure requests are coming from trusted sources. However, careful crafting of URLs can bypass poorly implemented checks, such as:
* **Modifying Parameter Names**: Altering the names of parameters in POST or GET requests can help in preventing automated attacks.
* **CSRF Tokens**: Incorporating a unique CSRF token in each session and requiring this token in subsequent requests can significantly mitigate the risk of CSRF. The effectiveness of the token can be enhanced by enforcing CORS.
Maybe the form you want to abuse is prepared to send a **POST request with a CSRF token but**, you should **check** if a **GET** is also **valid** and if when you send a GET request the **CSRF token is still being validated**.
Applications might implement a mechanism to **validate tokens** when they are present. However, a vulnerability arises if the validation is skipped altogether when the token is absent. Attackers can exploit this by **removing the parameter** that carries the token, not just its value. This allows them to circumvent the validation process and conduct a Cross-Site Request Forgery (CSRF) attack effectively.
Applications **not tying CSRF tokens to user sessions** present a significant **security risk**. These systems verify tokens against a **global pool** rather than ensuring each token is bound to the initiating session.
Here's how attackers exploit this:
1.**Authenticate** using their own account.
2.**Obtain a valid CSRF token** from the global pool.
3.**Use this token** in a CSRF attack against a victim.
This vulnerability allows attackers to make unauthorized requests on behalf of the victim, exploiting the application's **inadequate token validation mechanism**.
For example, if it's **using a PUT** method you can try to **use a POST** method and **send**: _https://example.com/my/dear/api/val/num?**\_method=PUT**_
Applications may implement CSRF protection by duplicating the token in both a cookie and a request parameter or by setting a CSRF cookie and verifying if the token sent in the backend corresponds to the cookie. The application validates requests by checking if the token in the request parameter aligns with the value in the cookie.
However, this method is vulnerable to CSRF attacks if the website has flaws allowing an attacker to set a CSRF cookie in the victim's browser, such as a CRLF vulnerability. The attacker can exploit this by loading a deceptive image that sets the cookie, followed by initiating the CSRF attack.
However, **severs logic may vary****Content-Type** used **note that** so **values mentioned****others****`application/json`**_**,**_**`text/xml`**, **`application/xml`**_._
The first part of [**this CTF writeup**](https://github.com/google/google-ctf/tree/master/2023/web-vegsoda/solution) is explained that [Oak's source code](https://github.com/oakserver/oak/blob/main/router.ts#L281), a router is set to **handle HEAD requests as GET requests** with no response body - a common workaround that isn't unique to Oak. Instead of a specific handler that deals with HEAD reqs, they're simply **given to the GET handler but the app just removes the response body**.
If a **CSRF token** is being used as **defence** you could try to **exfiltrate it** abusing a [**XSS**](xss-cross-site-scripting/#xss-stealing-csrf-tokens) vulnerability or a [**Dangling Markup**](dangling-markup-html-scriptless-injection/) vulnerability.
A Form GET request is a type of HTTP request that is used to retrieve data from a server. It is commonly used when submitting a form on a website, where the form data is appended to the URL as query parameters.
#### Vulnerability
Form GET requests can be vulnerable to Cross-Site Request Forgery (CSRF) attacks. In a CSRF attack, an attacker tricks a victim into unknowingly submitting a malicious request on their behalf. Since the form data is included in the URL, an attacker can construct a URL with the malicious data and trick the victim into visiting it.
#### Exploitation
To exploit a CSRF vulnerability in a Form GET request, an attacker can create a malicious webpage or send a crafted URL to the victim. When the victim visits the webpage or clicks on the URL, the malicious request is automatically sent to the target server, using the victim's session and privileges.
#### Mitigation
To mitigate CSRF attacks in Form GET requests, it is recommended to use the POST method instead. The POST method does not include the form data in the URL, making it more secure against CSRF attacks. Additionally, implementing anti-CSRF tokens can provide an extra layer of protection by validating the origin of the request.
#### Example
Consider the following example of a vulnerable Form GET request:
In this example, an attacker can construct a malicious URL like `https://example.com/profile?username=attacker`, and trick the victim into visiting it. When the victim submits the form, the request will be sent to the server with the malicious username parameter.
A form POST request is a type of HTTP request that is used to submit data to a server. It is commonly used in web applications to send data from a form to the server for processing. When a user submits a form, the data entered into the form fields is sent to the server in the body of the request.
To make a form POST request, the `POST` method is used in the HTML form element. The form data is then sent to the server as key-value pairs in the body of the request. The server can then process the data and perform the necessary actions based on the submitted form data.
#### Klingon
**Form POST request**
#### English
A form POST request is a type of HTTP request that is used to submit data to a server. It is commonly used in web applications to send data from a form to the server for processing. When a user submits a form, the data entered into the form fields is sent to the server in the body of the request.
To make a form POST request, the `POST` method is used in the HTML form element. The form data is then sent to the server as key-value pairs in the body of the request. The server can then process the data and perform the necessary actions based on the submitted form data.
xh.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); //to send proper header info (optional, but good to have as it may sometimes not work without this)
A multipart/form-data POST request is a type of HTTP request that allows you to send binary data, such as files, along with other form data. This type of request is commonly used when uploading files through web forms.
#### Vulnerability
A common vulnerability associated with multipart/form-data POST requests is Cross-Site Request Forgery (CSRF). CSRF occurs when an attacker tricks a victim into performing an unwanted action on a website without their knowledge or consent. In the context of a multipart/form-data POST request, an attacker can craft a malicious request that, when executed by the victim, performs an action on their behalf.
#### Exploitation
To exploit a CSRF vulnerability in a multipart/form-data POST request, an attacker typically needs to trick the victim into visiting a specially crafted webpage or clicking on a malicious link. When the victim performs the action, such as submitting a form, the attacker's request is sent along with the victim's session cookies, allowing the attacker to perform actions on behalf of the victim.
#### Mitigation
To mitigate CSRF vulnerabilities in multipart/form-data POST requests, it is recommended to implement the following measures:
1. Use anti-CSRF tokens: Include a unique token in each form that is submitted via a multipart/form-data POST request. This token should be generated on the server-side and validated upon submission to ensure that the request is legitimate.
2. Implement SameSite cookies: Set the SameSite attribute on session cookies to restrict their usage to same-site requests only. This prevents the browser from sending session cookies along with cross-site requests, effectively mitigating CSRF attacks.
3. Implement strict referer policies: Configure the server to only accept requests that originate from trusted sources. This can be done by checking the Referer header and ensuring that it matches the expected domain.
By implementing these measures, the risk of CSRF attacks in multipart/form-data POST requests can be significantly reduced.
A `multipart/form-data` POST request is a type of HTTP request that allows you to send binary data, such as files, along with other form data. This is commonly used when uploading files through web forms.
#### Vulnerability
A vulnerability can arise when a website does not implement proper Cross-Site Request Forgery (CSRF) protection for `multipart/form-data` POST requests. CSRF occurs when an attacker tricks a victim into performing an unwanted action on a website without their knowledge or consent.
#### Exploitation
To exploit this vulnerability, an attacker can create a malicious website or send a crafted link to the victim. When the victim visits the website or clicks the link, their browser will automatically send a `multipart/form-data` POST request to the target website, performing the unwanted action.
#### Mitigation
To mitigate this vulnerability, it is important to implement proper CSRF protection mechanisms. This can include the use of anti-CSRF tokens, which are unique tokens generated for each user session and included in the `multipart/form-data` POST request. The server can then verify the token to ensure that the request is legitimate.
#### Example
The following example demonstrates a `multipart/form-data` POST request:
In this example, the request includes a file named `example.jpg` and a form field named `description`. The binary data of the file is included in the request body, separated by the specified boundary.
When an HTML form is submitted, the browser sends a POST request to the specified URL. This behavior can be exploited in a Cross-Site Request Forgery (CSRF) attack when the form is submitted from within an iframe.
To perform a CSRF attack using an iframe, an attacker can create a hidden iframe on a malicious website that contains a form with the target URL as its action. The attacker can then use JavaScript to automatically submit the form when the user visits the malicious website.
When the form is submitted, the browser will send a POST request to the target URL, including any data entered by the user. This can lead to unauthorized actions being performed on the user's behalf, as the browser will include any authentication cookies associated with the target website.
To prevent CSRF attacks, it is important to implement proper CSRF protection mechanisms, such as using anti-CSRF tokens or checking the origin of the request.
### **QaStaHvIS CSRF Token je 'ej 'ej POST request yIlo' iframe 'ej form**
To perform a Cross-Site Request Forgery (CSRF) attack, you need to steal the CSRF token from the target website and then use it to send a malicious POST request. One way to achieve this is by utilizing an iframe and a form.
To steal the CSRF token, you can create an iframe element in your own website that loads the target website's page containing the CSRF token. By accessing the iframe's content, you can extract the CSRF token using JavaScript.
Once you have obtained the CSRF token, you can construct a form with hidden fields that include the necessary parameters for the POST request. Set the form's action attribute to the target website's vulnerable endpoint and set the method attribute to "POST".
Next, use JavaScript to automatically submit the form when the iframe has finished loading. This will trigger the POST request with the stolen CSRF token, effectively performing the attack.
Here is an example of the HTML code for the iframe and form:
var hiddenField = document.createElement("input");
hiddenField.setAttribute("type", "hidden");
hiddenField.setAttribute("name", "csrfToken");
hiddenField.setAttribute("value", csrfToken);
form.appendChild(hiddenField);
document.body.appendChild(form);
form.submit();
};
</script>
```
Remember that CSRF attacks can have serious consequences, so always ensure that you have proper authorization and permission before attempting any such attack.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. This attack occurs when a malicious website, email, or other malicious source tricks a user's browser into making a request to a target website where the user is authenticated.
Socket.IO is a JavaScript library that enables real-time, bidirectional communication between web clients and servers. It uses WebSockets as the primary transport mechanism, but can fallback to other techniques such as long polling or server-sent events.
#### Exploiting CSRF with Socket.IO
To exploit CSRF with Socket.IO, the attacker needs to trick the victim into visiting a malicious website that contains a crafted Socket.IO connection. The malicious website can then use the victim's authenticated session to perform actions on the target website.
The following steps outline the process of exploiting CSRF with Socket.IO:
1. The attacker creates a malicious website that includes a Socket.IO connection to the target website.
2. The victim visits the malicious website while being authenticated on the target website.
3. The malicious website uses the Socket.IO connection to send requests to the target website, leveraging the victim's authenticated session.
4. The target website processes the requests as if they were legitimate, since they originate from the victim's browser with the victim's session.
#### Mitigation
To mitigate CSRF attacks with Socket.IO, the following measures can be implemented:
1. Implement CSRF tokens: Include CSRF tokens in Socket.IO requests and validate them on the server-side. This ensures that only legitimate requests are processed.
2. Use SameSite cookies: Set the SameSite attribute of cookies to "Strict" or "Lax" to prevent cross-site requests from being sent with cookies.
3. Implement CORS: Configure Cross-Origin Resource Sharing (CORS) headers on the server-side to restrict which domains can make requests to the Socket.IO endpoint.
4. Educate users: Raise awareness among users about the risks of visiting untrusted websites and clicking on suspicious links.
By implementing these measures, the risk of CSRF attacks with Socket.IO can be significantly reduced.
The code can be used to Brut Force a login form using a CSRF token (It's also using the header X-Forwarded-For to try to bypass a possible IP blacklisting):
The code sends a GET request to the login page to retrieve the CSRF token. It then sets the CSRF token in the login data and sends a POST request to the login page with the login data. The X-Forwarded-For header is used to spoof the source IP address and bypass IP blacklisting. Finally, the code checks if the login was successful by searching for a specific string in the response.
<summary><strong>Learn AWS hacking from zero to hero with</strong><ahref="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
