OWASP Security Shepherd Project - CSRF 7 (CSRF Challenge)
Challenge Solution This challenge provides a link for us to retrieve the CSRF token, so let's try to capture the HTTP request of it and see if there is any clues. It seems that the link will return csrfToken corresponding to the userId provided. Now, our challenge would be how could we know the userId of other users. If the userId parameter passed to the server allows SQL wild card characters ? (Ref: SQL Wildcard ) Let's try ' % ' character first! Unfortunately, no matter 1 '%', 10 '%'s, 20 '%'s, or 40'%'s are inputted, we always get "An Error Occurred!...". As a result, we need to try ' _ ' character instead. Yes! With 40 ' _ 's we could get a reponse! However, we don't know this csrfToken is belong to which user. Maybe it would belong to current user? Let's replace the first '_' character to an...