The document provides an overview of Cross-Site Request Forgery (CSRF) attacks, including their definition, impact, and testing methods. It outlines various defenses against CSRF and common misconceptions regarding their effectiveness, as well as techniques for bypassing these defenses. Additionally, it highlights the vulnerabilities of home DSL routers to CSRF exploits and mentions references for further reading.

1. Introduction to CSRF
Attacks &defenses.

2. Who Am I ?
I’m P.B.Surya.Subhash, a 17 Year old Coder, Hacker and a student.
Certified by Microsoft and was offered a job by Yahoo, Dell , Slideshare
and a couple of other MNC’s
Helped USA.Gov, Nic.in, NCSL, Netherlands.
pbssubhash@gmail.com@pbssubhashFb.me/pbssubhashLinkedin.com/in/pbssubhash

3. And many more…

4. • What’s CSRF ?
• Impact of CSRF
• How to test websites for CSRF ?
• Real time attack scenario of CSRF.
• Defenses against CSRF
• How to Bypass those defenses ?
• Using CSRF to compromise DSL Routers
• Conclusion 
Agenda

5. What’s this CSRF ?
•CrosssiterequestforgeryabbreviatedasCSRFandalsoknownasSession
Riding.
•Forcesanendusertoexecuteunwantedactionsonawebapplicationin
whichhe/sheiscurrentlyauthenticated.

6. Impact
 A successful CSRF exploit can compromise end user data and
operation in case of normal user.
 If the targeted end user is the administrator account, this can
compromise the entire web application.

7. That’s all ?
• Anythinganauthenticatedusercando
• Norestrictionfromsameoriginpolicy,except…
• Attackerscannotreadresponsesfromotherorigins
• Limitedonwhatcanbedonewithdata
• Severeimpactonaccountability-Logentriesreflecttheactionsavictimwastrickedinto
executing

8. How to find
these ?So lets break it !
(root@null: rm –rf /root/earth/security/)

9. Let’s Exploit it !

10. Killer Combination !
• Persistent Script Injection + CSRF = PWN3D

11. defenses
 The simplest one is to validate the Referrer header in the HTTP Request preventing the request from unknown
sources.
 The most popular one remains the token.
 Custom HTTP Header like X-Requested-By: My Site.com – Not so popular…
 Same Orgin Policy.
 Re-authentication
 Captcha

12. Common Mistakes :-
• Not validating the token ..
• Not applying captcha properly.
Example :-
http://www.youtube.com/watch?v=zl0ARKQhoLA

13. Misconceptions – Defenses That Don’t Work
 Only accept POST
 Stops simple link-based attacks (IMG, frames, etc.)
 But hidden POST requests can be created with frames, scripts, etc…
 Referrer checking
 Some users prohibit referrers, so you can’t just require referrer headers
 Techniques to selectively create HTTP request without referrers exist
 Requiring multi-step transactions
 CSRF attack can perform each step in order
None of these approaches will sufficiently protect against CSRF!

14. Intro on How to Bypass those defenses ?
• Clickjacking
• Bypassing SOP
• Insecure CrossDomain.XML
• Openly available exploits
• Bypassing the captcha
• Checking Token Validation
• Checking header Validation
• Converting POST based requests to GET based requests.

15. CSRF to compromise DSL Routers ?
• Home DSL routers aren't secure from specialized CSRF attacks.
Once the DSL router is owned, attackers can have their way with
the internal network.
Initiate a connection to the new DSL router.
Turn on remote management.
Add a password to the Admin user account.

16. Demo Time

17. References :-
• https://en.wikipedia.org/wiki/Cross-site_request_forgery
• https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
• https://docs.djangoproject.com/en/dev/ref/contrib/csrf/
• https://projects.webappsec.org/Cross-Site-Request-Forgery
• https://www.owasp.org/index.php/Cross-
Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

18. Anything to ask ?

19. Bye !
Please drop your suggestions at @pbssubhash (or) pbssubhash@gmail.com
Thank You!