What is CSRF?
CSFR is Cross Site Request Forgery (sometimes denoted by XSRF, X = "cross"). Don't confuse CSRF with CSS/XSS. The difference between CSRF and XSS is:
In XSS, the trust for a user on the website is exploited whereas in CSRF, the trust that a web server has on a user is exploited.
The whole CSRF exploit revolves around the way the server authenticates a user. It is basically sending out malicious HTTP requests without the user's consent/knowledge.
Lets say this is the HTTP request sent to a web server to transfer money from one account to another account:
As we can see the POST variables are Money and toAccount. Now lets look at the way, a user is being authenticated by the website:
With that type of authentication, the web server can't be sure if the request was made by the legit user or by a malicious user by the use of CSRF.
Let's take a look at the malicious code the attacker writes to send himself money.
The above script submits itself to the transfer page with all the values required. When the legitimate user visits a page with that malicious code in, the form automatically sends a HTTP request to the webapp, basically asking it to send money to the account "john" without the intervention of the user. This happens mostly due to the lack of proper authentication of user submitted requests.
Counter measures:
Create authentication tokens for every request and validate them.
CSFR is Cross Site Request Forgery (sometimes denoted by XSRF, X = "cross"). Don't confuse CSRF with CSS/XSS. The difference between CSRF and XSS is:
In XSS, the trust for a user on the website is exploited whereas in CSRF, the trust that a web server has on a user is exploited.
The whole CSRF exploit revolves around the way the server authenticates a user. It is basically sending out malicious HTTP requests without the user's consent/knowledge.
Lets say this is the HTTP request sent to a web server to transfer money from one account to another account:
PHP Code
<?php
POST /csrf/Transfer HTTP/1.1
Referer: http://localhost/csrf
User-Agent: ...
Content-Type: application/x-www-form-urlencoded
Host: 127.0.0.1:54607
Content-Length: xx
Cookie: .PHPSESSID=sjas7dsakjdsa7
Money=10000&toAccount=mike
As we can see the POST variables are Money and toAccount. Now lets look at the way, a user is being authenticated by the website:
PHP Code
<?php
$username = 'user';
$password = 'pass';
session_start();
$_SESSION['in'] = 1;
$_SESSION['user'] = $username;
With that type of authentication, the web server can't be sure if the request was made by the legit user or by a malicious user by the use of CSRF.
Let's take a look at the malicious code the attacker writes to send himself money.
PHP Code
<?php
<form name="transfer" method="post" action="http://localhost/csrf/transfer">
<input type="hidden" name="Money" value="100000">
<input type="hidden" name="toAccount" vale="john">
</form>
<script>document.transfer.submit()</script>
The above script submits itself to the transfer page with all the values required. When the legitimate user visits a page with that malicious code in, the form automatically sends a HTTP request to the webapp, basically asking it to send money to the account "john" without the intervention of the user. This happens mostly due to the lack of proper authentication of user submitted requests.
Counter measures:
Create authentication tokens for every request and validate them.
![[Image: eBxEg.gif]](https://i.imgur.com/eBxEg.gif)
