Private Crypter - Unique Private Stubs ◆ Traffic service & campaign optimization ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › Need someone to verify CSRF

New Reply 

Need someone to verify CSRF
0xB9
0xB9 Offline
[closed@HF:]
Posts:
753
Threads:
8
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 14, 2018 12:41 PM (This post was last modified: Dec 13, 2018 01:22 PM by 0xB9.)
As title says... I found a CSRF but owner of the CMS is saying it's not a vuln, just need someone to take a minute to confirm.

It seems very obvious by the message he sent me that he's not sure how a CSRF works..
Quote:what I have found is if you do this all while logged in and using the same browser session this worked, and I was able to use the script offline to create a new user. However, if I was logged in using Chrome, and then tried using the offline script in incognito mode (or another browser or even another computer), this DID NOT WORK.


If you have a quick minute and not a total noob PM for info.
connectover
connectover Offline
[n00b@HF:]
*
Registered
Posts:
20
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 15, 2018 05:29 AM
Yeah he seems to think running scripts offline will have an effect on a foreign server? He's batshit.
Abruptum
Abruptum Offline
[bin@HF:]
*
Registered
Posts:
685
Threads:
6
Credibility:
000
Popularity:
47
βytes:
β 0
Game XP:
0
Nov 15, 2018 08:14 AM
(Nov 14, 2018 12:41 PM)0xB9 Wrote:  As title says... I found a CSRF but owner of the CMS is saying it's not a vuln, just need someone to take a minute to confirm I'm not retarded.

It seems very obvious by the message he sent me that he's not sure how a CSRF works..


If you have a quick minute and not a total noob PM for info.

It seems like don't understand the reason why this is a problem. Try to find possible exploitation vectors which will impress him (like creating a new page when he visits your malicius CSRF)
0xB9
0xB9 Offline
[closed@HF:]
Posts:
753
Threads:
8
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 15, 2018 12:28 PM (This post was last modified: Nov 15, 2018 12:29 PM by 0xB9.)
(Nov 15, 2018 08:14 AM)Abruptum Wrote:  It seems like don't understand the reason why this is a problem. Try to find possible exploitation vectors which will impress him (like creating a new page when he visits your malicius CSRF)

The site uses CSRF tokens, but it fails to verify the token when making a request which leads to the CSRF.

And I have exploited it for him, it allows to create another admin. He even did it himself, but wrote it off since it didn't work on 2 different computers or whatever the hell he tried to do...
(Nov 15, 2018 05:29 AM)connectover Wrote:  Yeah he seems to think running scripts offline will have an effect on a foreign server? He's batshit.

Yea.. he's trying to exploit a CSRF in 2 different browsers/computers... so no shit it's not working for him. LOL
๖ۣۜCriminal
๖ۣۜCriminal Offline
[closed@HF:]
Posts:
2,915
Threads:
280
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 15, 2018 10:11 PM
Own the site and when he realizes you have DBMS access he will shit him self and get right on it, I would just show you logged into the admin panel a full on root is overkill but you can potentially escalate the csrf2rce
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by JfndfMar 13, 2024 08:06 AM 0 153 Mar 13, 2024 08:06 AM
Last Post: Jfndf
by cyberpunk3077Mar 6, 2021 11:48 AM 7 297 Mar 6, 2021 11:48 AM
Last Post: cyberpunk3077
by Mr8nOct 22, 2018 11:39 AM 2 191 Oct 22, 2018 11:39 AM
Last Post: SlowMehMo