Cross-Site Request Forgery (CSRF) is an attack where an attacker forges requests as a trusted user, exploiting a web application's blind trust in browser requests. This can lead to various damages including unauthorized transactions in net-banking and unauthorized modifications of personal health information. Mitigation techniques include using CSRF tokens in forms and implementing CAPTCHA to verify user interactions.

1. Cross Site Request Forgery
(CSRF)
Author :Sneha Nehatkar
March, 2017

2. www.valencynetworks.com
Key Points
• What is Cross Site Request Forgery (CSRF)?
• How Attack Can Happen?
• Damages caused by CSRF?
• Mitigations

3. www.valencynetworks.com
What is Cross Site Request Forgery (CSRF)?
• CSRF is an attack in which attacker forges the request as a trusted user.
The request is essentially made to send unintended data to the site. A
vulnerable web application assumes that the data is coming from a
trusted user.
• The root cause is – request coming from browser is trusted by server
blindly, if CSRF protection is not implemented.
• This “blind trust” lets attacker create a forged request, and make the
victim perform that request.

4. www.valencynetworks.com
How Attack Can Happen?
• Attacker knows about target application, on which the attack is to be
performed
• Attacker forges request and sends it to victim who may be logged into
the website by embedding that forged request into a hyperlink
• Victim clicks on it, and unknowingly sends malicious request to website
• Website accepts it and processes it. Thus the attacker is successful in
performing the attack.

5. www.valencynetworks.com
CSRF Work Flow Diagram
Attacker Victim
Send forged request by phishing or any other technique
Victim click on it
unknowingly and send it
Webserver validate it and
attacker get whatever he/she
wants
1
2
3

6. www.valencynetworks.com
Damages caused by CSRF?
• In Net-banking attacker can forge the request and send it to victim to
steal money from Victim’s account
• Personal health information can be stolen or modified in a hospital
database
• Attacker force victim to perform unwanted action which affect their
profile

7. www.valencynetworks.com
Mitigation Techniques
• Can be mitigate by two ways
– CSRF token (a cookie which is introduced in each form and validated by web app)
– Captcha (implemented to ensure that the request is being performed by a human
interaction)
CSRF Token Captcha

8. www.valencynetworks.com
An ISO27001 Certified Company
http://www.valencynetworks.com
sales@valencynetworks.com
Facebook Twitter Linkedin