Session Cross Site Request Forgery

Cross site request Forgery
Missing Function Level Access Control
----------------------------------------
Cross site request Forgery.
In this attack the hacker creates a forged http request and tricks victim into submitting that request via images tabs or xss
The application allows a user to submit a state changing request that does not include anything secret.

For example:
http://anywebsite.com/app/transferFunds?amount=1500&destinationAccount=4673243243
this all done by making the victim click on a link or on a certain appealing image
________
DEMO DVWA


Steps

Step 1 Open XAMPP start mysql and apache server

step 2 go to your browser in the 'url field' type 127.0.0.1/dvwa

step 3 login in to dvwa with username="admin" and password="password"

step 4 goto to dvwa security change the security level to "low"

step 5 goto click on "CSRF" tab on the left side

step 6 inspect element

step 7 select the form with the cursor

step 8 right click on "<form action= '#' " click on "Edit as HTML"

step 9 copy the code and open up a notepad file.

step 10 replace the '#' in action= to "127.0.0.1/dvwa/vulnerabilities/csrf"

step 11 save the file as html

step 12 open the saved file in the new tab note-> your old tab should also be open and change the password in the newly created file.(change your password to admin)

step 13 after practice reverse the password to password.

#For LVS

step 1 open 127.0.0.1/lvs111

step 2 click on csrf >Gmail logout options

step 3 open a gmail in a new tab

step 4 open the lvs tab and click on submit querry

and your gmail account would be logged out.


LVS-2 comment box
step 1 open 127.0.0.1/lvs111

step 2 click on csrf > csrf in comment box

step 3 type a comment if you want to

step 4 click on the iphone photo

step 5 Click on back button

and a comment would be posted that was not earlier there.

________________________________________________

Missing Function Level Access Control
---------------------------------------------
It is an attack in which a hacker or an anonymous person is able to access an application interface that it would otherwise never been able to access.

eg if a hacker open up

www.anywebsite.com/user
and logs in with credentials after that get redirected to
www.anywebsite.com/admin

Now if a hacker is able to type www.anywebsite.com/admin and is able to enter without using credentials that is case of Missing Function Level Access Control.

---

steps

Step1 goto 127.0.0.1/lvs111

step 2 Click on Missing Function Level Access control "unauthenticate user access to admin"

step 3 login with credentials admin and password

step 4 copy url

step 5 click on logout and paste the url

try to do the same with "Authenticated user access to admin"

CSRF
=====
CSRF stands for Cross/Client Site Request Forgery. A CSRF attack forces an authenticated user (victim) to send a forged HTTP request, including the victim's session cookie to a vulnerable web application, which allows the attacker to force the victim's browser to generate request which is not actually made by user ....


The browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, Windows domain credentials, and so forth. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish between the forged request sent by the victim and a legitimate request sent by the victim.

Eg. already logged in into a bank site and clicking on a ad on other malicious website stating "click here to win an iphone X" and is malicious.


----------------------------------------------------------------------------------------------------------------------------

MISSING FUNCTION LEVEL ACCESS CONTROL
=====================================

Let us first understand what Access Control means.
Access Control : access control is a process by which users are granted access and certain privileges to systems, resources or information. This term is usually derives for Authentication Checks.

Most of the web applications verify function level access rights before making that functionality accessible to the user. Missing Function Level Access Control is one of the vulnerabilities on OWASP's Top 10 list and occurs when those authentication function checks are insufficient and attackers misuse them.


    www.abc.com/login/login.php?id=user
     _________
    |		      |
    |normal   |
    |   user  |
    |         |
    |_________|


    www.abc.com/login/login.php?id=admin

    ____________
   |		      	|
   |ADMIN Panel |   <--- Redirect you to admin panel
   |			      |        No access control
   |			      |
   |____________|

Demonstration on LVS via Unrestricted User Access to the Admin Account.

----------------------------------------------------------------------------------------------------------------------------

UNVALIDATED REDIRECTS AND FORWARDS
===================================


Most web applications on the internet frequently redirect and forward users to other pages or other external websites.
Invallidated/Unvalidated redirects and forwards means redirecting a authenticated and valid user to a phishing or malicious web page which defines a malicious activity created by the attacker as using forwards to access unauthorized pages.

How to find the redirecting value?
There is a redirect to="url" value in the Hyperlinks, this will signify that the URL is redirecting us to a particular malicious link.


www.ronak.com/login/redirectTo=www.google.com/antwasp





Demonstration on LVS of Manual Redirects and Automatic Redirects.

------------------------------------------------------------------------------------------------------------------------
Automated VAPT Tool - NETSPARKER
================================

Netsparker is a web application security scanner, with support for both detection and exploitation of vulnerabilities. It is like Acunetix only, but more advanced and flexible in Report Generation and finding out Vulnerabilities.

Demo Application - https://www.netsparker.com/web-vulnerability-scanner/download/

Demonstration of Report Generation and explanation on demo.testfire.net via Netsparker.

----------------------------------------------------------------------------------------------------------------------------