1. Riding Someone Else’s Wave with CSRF
Sam Shute

2. Overview What is CSRF What can we use CSRF for Where can we find CSRF
How can we defend against CSRF

3. What is CSRF - Why should I care
CSRF, Sea-Surf, XSRF, one-click attacks, session riding. All mean Cross-Site Request Forgery.
Sending requests from someone else’s browser, so their browser adds their cookies.
Recently removed from the OWASP Top10

4. What is CSRF – Real Life Examples
Penetration test on Friday
80% of our penetration tests
uTorrent malware download
Gmail contact list theft

5. What is CSRF - Flow User visits our malicious/infected site
The users browser loads the content for our site, including our CSRF attack
The users browser sends the request with their cookies

6. What is CSRF - Example
Antonio requests a site we’ve infected, DogMemes.com
Antonio’s browser loads the infected page, including our CSRF attack
When it comes across our CSRF his browser makes a request to AntoniosBank.com with his cookie, telling his bank to put $10,000 into our account.

7. What is CSRF - Example

9. Same-Origin Policy Same-Origin = Same Domain
Blocks background requests that come from a different domain.
Modern Browsers only

10. Demo

11. CSRF Attack 1: Making a Post
Simple HTML form
Executed through a phishing attack

12. CSRF Attack 1-2: Making a Post

13. CSRF Attack 2: Password Change
Background Ajax request
Executed through an XSS injection

14. CSRF Attack 3: Privilege Escalation
Background Ajax request
Executed through an XSS injection

15. What can we use CSRF for Making posts Changing passwords
Privilege escalation
Creating accounts
Transferring bank funds

16. Where can we find CSRF
Any request that does not pass a CSRF token is probably vulnerable.
Looking at forms and ajax requests are always a good place to start.

17. Defending Yourself against CSRF
Logging out when finished with an application
Running a script blocker
Updating

18. What doesn’t work to defend against CSRF
HTTPS
Using only POST requests
Secret cookie values
Relying on browser-based protections

19. What does work against CSRF
CSRF Tokens
Must be unique per user, preferably unique per action.
They must be implemented, but more importantly, they must be validated.
Check your framework
Content-Security-Policy
Doesn’t actually stop CSRF. But by declaring a strict CSP you can reduce the attack surface for XSS.

20. What does work against CSRF – CSRF Tokens

21. What does work against CSRF – CSRF Tokens

22. What does work against CSRF – CSRF Tokens

23. Summary
Very easy to exploit
Very easy to defend against

24. Questions?