> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/web-attacks/csrf.md). # CSRF Allows an attacker to induce users to perform actions that they do not intend to perform. **Steps**: * Check action * Check defences
CSRF tokensValue to check
SameSite cookiesBrowser security mechanism that prevent cookies from being included in requests originating from an attacker.
Included in Set-Cookie and with 3 restriction levels: Strict, Lax (default in chrome), None (+ Secure attribute)
Referer-based validationUse of the HTTP Referer header to attempt to defend
Right click on request > Engagement tools > [Generate CSRF PoC](https://portswigger.net/burp/documentation/desktop/tools/engagement-tools/generate-csrf-poc). ## Bypassing ### CSRF base * Change request method GET/POST * Remove CSRF token * Use CSRF token of its own session {% code overflow="wrap" %} ```html
``` {% endcode %} ### CSRF in header Need to find a way to inject header. ``` %0d%0aSet-Cookie:%20csrf=FAKE%3b%20SameSite=None ``` * **CSRF sessions** (es. `csrfKey` in cookie header and `csrf` in body)\ The CSRF session isn't associated with the user session.\ Try to inject and use CSRF header and token of its own session. * **CSRF token is duplicated in a cookie header**\ Try to injectthe same CSRF token in cookie header and body. ### SameSite Lax {% code overflow="wrap" %} ```html ``` {% endcode %} In Symfony `_method` takes precedence over the normal method. {% code overflow="wrap" %} ```html
``` {% endcode %} {% code overflow="wrap" %} ```html https://vulnerable-website.com/account/transfer-payment?recipient=hacker&amount=1000000&_method=POST' ``` {% endcode %} Other frameworks support a variety of similar parameters. #### Cookie Refresh To avoid breaking single sign-on (SSO) mechanisms, SameSite Lax allows on top-level `POST` requests in the first 120 seconds.\ So you can trigger the cookie refresh from a new tab.\ Browsers block popup tabs unless they're opened via a manual interaction. ```html

Click anywhere on the page

``` ### SameSite Strict Find a gadget that results in a secondary request within the same site.\ One possible gadget is a client-side redirect that dynamically constructs the redirection target using attacker-controllable input like URL parameters. ### Referer Header Some applications skip the validation if the header is omitted.\ The easiest way to do that is using a META tag within the HTML page that hosts the CSRF attack. ```html ``` bypassing the naive way of checking ``` http://vulnerable-website.com.attacker-website.com/csrf-attack ``` ``` http://attacker-website.com/csrf-attack?vulnerable-website.com ``` For pushing Referer header in Javascript {% code overflow="wrap" %} ```javascript history.pushState("", "", "/?value-referer") ``` {% endcode %} Many browsers now strip the query string from the Referer header by default as a security measure.\ To override this behavior and ensure that the full URL is included in the request add the following header to the "Head" section in webhook: ``` Referrer-Policy: unsafe-url ``` ## CSRF WebSocket hijacking CSRF vulnerability on a [WebSocket handshake](https://portswigger.net/web-security/websockets/what-are-websockets#how-are-websocket-connections-established).\ Unlike regular CSRF, the attacker gains two-way interaction with the compromised application.\ You typically need to find a handshake message that relies solely on HTTP cookies for session handling and doesn't employ any tokens or other unpredictable values in request parameters. {% code overflow="wrap" %} ```html ``` {% endcode %}