A CSRF instance vulnerability mining belt you know what CSRF is.

[-] What the hell is a csrf?

|___ a simple understanding:

|----An attacker who stole your identity and carried out some illegal operations on your behalf. CSRF can use your account to send emails, get your sensitive information, and even steal your property.

|___CSRF Attack principle:

|----When we open or log in to a website, the browser and the server hosting the website will generate a session (cookies), and you can use your privileges to manipulate the site when the session is not over. However, an attacker would use this feature to allow a victim to trigger a form or statement that we construct, and then achieve what the attacker wants to achieve.

[+] How do I construct the form?

The form of the |___get method is simple, triggering directly on the URL construct.

|----slightly.

|___post Form Construction (mainly demonstrates this).

|----tool with burpsuite or csrftest (mainly used in the former).

[*] actual combat begins:

|----Target Station: http://119.29.55.24

|----Target Vulnerability Address: Login website after registration, the vulnerability exists in the change password, because there is no protection (even two times the verification did not!!) At least the verification code to give a AH)

|----Open the Burpsuite grab bag.

　　

|----Right-click on this and select Engagement Tools--->generate CSRF POC save segment form code to local.

　　　　

* Note: Hash that paragraph deleted can also continue to use, please self-test, you can also keep.

|___ then switch between browsers to switch users, and then use the browser to open a locally saved form. Click the Submit button, then you can see "Password modification Success", which means that the construction of the CSRF trigger success!!

|----Here I re-registered an account with Googlechrome to trigger the form of this construct.

　　　　

When you exit the login, you can find that the password has been modified!

If the user volume is large, you can directly modify the target account. Administrator account can also be modified.

By the way, to tell a small trick, with JS automatically triggered by the victim without the click Submit Form OH. It means that people can directly trigger csrf! by clicking on the connection.

Reprinted from: http://www.cnblogs.com/loid/p/5746444.html

A CSRF instance vulnerability mining belt you know what CSRF is.