To illustrate this technique we have a webapp that features same origin/same site protections as well as anti-csrf measures, but is vulnerable to an XSS attack.

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

Essentially, we store the CSRF payload/attack on the website using XSS

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

But before we hack away, we have to consider what we want to hack. In this example, we will use the exploit to make private profiles public - fancy.

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

So let's see how this app makes our profile public - by just playing around and making our profile public and sending the generated traffic to burp

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

In order to execute this request, we have to "smuggle" this JS Code into the website (using xss):

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

Most of the script above is to replicate the request, if you're familiar with js it shouldn't be that hard/surprising and I'm sure burp has some kind of feature or extension to convert a request into JavaScript Code.

But the interesting part (for me at least) is this line:

var token = this.responseText.match(/name="csrf" type="hidden" value="(\w+)"/)[1];

This line parses the html of the website that is currently open and matches a regex-like expression. This expression looks for a line with the attributes name=csrf and type=hiden and extracts the value: our csrf token.

So even if it's randomly generated, we can get it  

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

Also let's not forget that weak csrf tokens happen also (very often?)

• Try to find how tokens are generated (i.e. md5(username) we could verify check that by logging in and seeing our csrf tokens)

Check for the following and similar "token generation algorithms":

• md5(username)
• sha1(username)
• md5(current date + username)

This can be done with a simple bash command:

etc...

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting

A little overview of protection bypasses

| Type | Explanation | Example |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Null Value | Just leave the token Empty, Sometimes Server just checks for the headers | CSRF-Token: |
| Random CSRF Token | Recreate a fake token with random values | Real:

CSRF-Token: 9cfffd9e8e78bd68975e295d1b3d3331

Fake:

CSRF-Token: 9cfffl3dj3837dfkj3j387fjcxmfjfd3 |
| Use another Session's CSRF Token | Create multiple accounts and try the csrf token of Account A for a Request of Account B | - |
| Request Method Tampering | Change the request type from. GET to POST | Original

http<br>POST /change_password<br>POST body:<br>new_password=pwned&confirm_new=pwned<br>

Fake

http<br>GET /change_password?new_password=pwned&confirm_new=pwned<br> |
| Delete token | Just remove the token in general. Do not send token (it may work) | |
| Session Fixation | If website keeps anti-csrf token in cookie and params, it probably isn't keeping the token on the server so just fix your token | http<br>POST /change_password<br>Cookie: CSRF-Token=fixed_token;<br>POST body:<br>new_password=pwned&CSRF-Token=fixed_token<br> |
| Regex Bypass | You can try to bypass Regex checks for website whitelists etc... | www.google.com.pwned.zanidd.xyz or something like that |

Don't know how good mastodon handles markdown tables, but you can see it at https://notes.zanidd.xyz/cybersecurity-and-hacking/web/session-security a little better.

#xss #csrf #hacking #cybersecurity #crosssiterequestforgery #crosssitescripting #pentesting