CSRF protection for web apps

-

CSRF - Cross Site Request Forgery 



when users authenticated to the web service or app it will creates an session cookies and some other cookies to identify the user resubmit data to the server after authenticate process.

Attackers are gain advantage of this process, they create an web page to  trick the users and get clicked to an link or button to submit data behalf of the users without known them.

as and example - attacker create an malicious website that has a link saying "click this to win the price"


but there are another hidden field that contain hidden data that attacker actually wants to post on your facebook status. but user don't see it.

when user clicks on the link that hidden field data will be submitted to the facebook url as POST method.

now the attacker successfully trick the user to put something attacker wants in as users facebook status.

How to prevent CSRF

there ate main two methods use in commonly to prevent csrf attacks.

  1. Synchronizer token pattern - click here to see how its done
  2. Double submit token cookie - click here to see how its done

Comments

Post a Comment

Popular posts from this blog

Hack The Box - How to hack in to the game ;)

-
Image
Firs of all lets see what is the Hack The Box   😎😎😎 "Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with other members of similar interests. It contains several challenges that are constantly updated. Some of them simulating real world scenarios and some of them leaning more towards a CTF style of challenge. As an individual, you can complete a simple challenge to prove your skills and then create an account, allowing you to connect to Hack The Box's private network (HTB Labs) where several machines await for you to hack them. By hacking machines you get points that help you advance in the Hall of Fame." when you go down the page you will be ask to click a button to join the HTB, go ahead and click it this is the first step to get invite code after you click it you will be end up a page like this asking an invite code which you wont have. don't get confused , le
Read more

implement CSRF protection - Synchronizer token pattern

-
Image
what is synchronizer token pattern ?  as above figure, first client browser request login page and log in to the system. same time server generates CSRF token and store it on server side. next time user interact with the server, user ask server to send CSRF token with AJAX and user submit data along with CSRF token.  so server can verify this request came from legitimate user by comparing CSRF token received and own. How to implement ? In this web app there are 3 files  client side -> index.html  server side -> login.php                         sever.php step 1 - login UI     you need to model simple its index.html this is the main page of the app. this is my index.html step 2 -  when user click log in data will send to server side (login.php) and authenticate user.  then only if user authenticated client browser will create a new cookie with current session id and relevant information. step 3 -  same time sever will be genera
Read more

Jaggery From WSO2

-
Image
Lets See what is jaggery .. Jaggery is a framework developed by WSO2, to write web apps and HTTP-focused web services for all aspects of the application: front-end, communication, Server-side logic and persistence in pure Javascript. One of the intents of this framework is to reduce the gap between writing web apps and web services. Importantly, Jaggery is open-source and released under Apache 2.0. As a pure Javascript server-side scripting engine, Jaggery combines all the strengths of Javascript with flexibility and freedom at both the development and deployment stages. Most JavaScript webapp development mechanisms restrict developers to a framework-specific structure or patterns, which demand an additional learning curve. By contrast, with Jaggery, any developers who are versed in Javascript have everything they need to get going.  you can download and try the language from the visiting Jaggery website. so lets download and try it... visit the jaggery we
Read more