mirror of
https://github.com/usestrix/strix.git
synced 2026-08-16 09:26:39 +02:00
169 lines
4.3 KiB
Django/Jinja
169 lines
4.3 KiB
Django/Jinja
<csrf_vulnerability_guide>
|
|
<title>CROSS-SITE REQUEST FORGERY (CSRF) - ADVANCED EXPLOITATION</title>
|
|
|
|
<critical>CSRF forces authenticated users to execute unwanted actions, exploiting the trust a site has in the user's browser.</critical>
|
|
|
|
<high_value_targets>
|
|
- Password/email change forms
|
|
- Money transfer/payment functions
|
|
- Account deletion/deactivation
|
|
- Permission/role changes
|
|
- API key generation/regeneration
|
|
- OAuth connection/disconnection
|
|
- 2FA enable/disable
|
|
- Privacy settings modification
|
|
- Admin functions
|
|
- File uploads/deletions
|
|
</high_value_targets>
|
|
|
|
<discovery_techniques>
|
|
<token_analysis>
|
|
Common token names: csrf_token, csrftoken, _csrf, authenticity_token, __RequestVerificationToken, X-CSRF-TOKEN
|
|
|
|
Check if tokens are:
|
|
- Actually validated (remove and test)
|
|
- Tied to user session
|
|
- Reusable across requests
|
|
- Present in GET requests
|
|
- Predictable or static
|
|
</token_analysis>
|
|
|
|
<http_methods>
|
|
- Test if POST endpoints accept GET
|
|
- Try method override headers: _method, X-HTTP-Method-Override
|
|
- Check if PUT/DELETE lack protection
|
|
</http_methods>
|
|
</discovery_techniques>
|
|
|
|
<exploitation_techniques>
|
|
<basic_forms>
|
|
HTML form auto-submit:
|
|
<form action="https://target.com/transfer" method="POST">
|
|
<input name="amount" value="1000">
|
|
<input name="to" value="attacker">
|
|
</form>
|
|
<script>document.forms[0].submit()</script>
|
|
</basic_forms>
|
|
|
|
<json_csrf>
|
|
For JSON endpoints:
|
|
<form enctype="text/plain" action="https://target.com/api">
|
|
<input name='{"amount":1000,"to":"attacker","ignore":"' value='"}'>
|
|
</form>
|
|
</json_csrf>
|
|
|
|
<multipart_csrf>
|
|
For file uploads:
|
|
Use XMLHttpRequest with credentials
|
|
Generate multipart/form-data boundaries
|
|
</multipart_csrf>
|
|
</exploitation_techniques>
|
|
|
|
<bypass_techniques>
|
|
<token_bypasses>
|
|
- Null token: remove parameter entirely
|
|
- Empty token: csrf_token=
|
|
- Token from own account: use your valid token
|
|
- Token fixation: force known token value
|
|
- Method interchange: GET token used for POST
|
|
</token_bypasses>
|
|
|
|
<header_bypasses>
|
|
- Referer bypass: use data: URI, about:blank
|
|
- Origin bypass: null origin via sandboxed iframe
|
|
- CORS misconfigurations
|
|
</header_bypasses>
|
|
|
|
<content_type_tricks>
|
|
- Change multipart to application/x-www-form-urlencoded
|
|
- Use text/plain for JSON endpoints
|
|
- Exploit parsers that accept multiple formats
|
|
</content_type_tricks>
|
|
</bypass_techniques>
|
|
|
|
<advanced_techniques>
|
|
<subdomain_csrf>
|
|
- XSS on subdomain = CSRF on main domain
|
|
- Cookie scope abuse (domain=.example.com)
|
|
- Subdomain takeover for CSRF
|
|
</subdomain_csrf>
|
|
|
|
<csrf_login>
|
|
- Force victim to login as attacker
|
|
- Plant backdoors in victim's account
|
|
- Access victim's future data
|
|
</csrf_login>
|
|
|
|
<csrf_logout>
|
|
- Force logout → login CSRF → account takeover
|
|
</csrf_logout>
|
|
|
|
<double_submit_csrf>
|
|
If using double-submit cookies:
|
|
- Set cookie via XSS/subdomain
|
|
- Cookie injection via header injection
|
|
- Cookie tossing attacks
|
|
</double_submit_csrf>
|
|
</advanced_techniques>
|
|
|
|
<special_contexts>
|
|
<websocket_csrf>
|
|
- Cross-origin WebSocket hijacking
|
|
- Steal tokens from WebSocket messages
|
|
</websocket_csrf>
|
|
|
|
<graphql_csrf>
|
|
- GET requests with query parameter
|
|
- Batched mutations
|
|
- Subscription abuse
|
|
</graphql_csrf>
|
|
|
|
<api_csrf>
|
|
- Bearer tokens in URL parameters
|
|
- API keys in GET requests
|
|
- Insecure CORS policies
|
|
</api_csrf>
|
|
</special_contexts>
|
|
|
|
<validation>
|
|
To confirm CSRF:
|
|
1. Create working proof-of-concept
|
|
2. Test across browsers
|
|
3. Verify action completes successfully
|
|
4. No user interaction required (beyond visiting page)
|
|
5. Works with active session
|
|
</validation>
|
|
|
|
<false_positives>
|
|
NOT CSRF if:
|
|
- Requires valid CSRF token
|
|
- SameSite cookies properly configured
|
|
- Proper origin/referer validation
|
|
- User interaction required
|
|
- Only affects non-sensitive actions
|
|
</false_positives>
|
|
|
|
<impact>
|
|
- Account takeover
|
|
- Financial loss
|
|
- Data modification/deletion
|
|
- Privilege escalation
|
|
- Privacy violations
|
|
</impact>
|
|
|
|
<pro_tips>
|
|
1. Check all state-changing operations
|
|
2. Test file upload endpoints
|
|
3. Look for token disclosure in URLs
|
|
4. Chain with XSS for token theft
|
|
5. Check mobile API endpoints
|
|
6. Test CORS configurations
|
|
7. Verify SameSite cookie settings
|
|
8. Look for method override possibilities
|
|
9. Test WebSocket endpoints
|
|
10. Document clear attack scenario
|
|
</pro_tips>
|
|
|
|
<remember>Modern CSRF requires creativity - look for token leaks, chain with other vulnerabilities, and focus on high-impact actions. SameSite cookies are not always properly configured.</remember>
|
|
</csrf_vulnerability_guide>
|