Cross-site request forgery (CSRF) - ICSS

What is CSRF?

Cross-site request forgery (CSRF) is a web security flaw that allows an attacker to trick users into performing actions they do not intend to accomplish. It enables an attacker to partially bypass the same origin policy, which is intended to prevent distinct websites from interfering with one another.

What is the consequence of a CSRF attack?

In a successful CSRF attack, the attacker causes the victim user to perform an accidental action. This could be to update their email address, reset their password, or make a money transfer, for example. The attacker may be able to obtain complete control of the user's account depending on the nature of the action. If the compromised user has a privileged role within the application, the attacker may be able to take complete control of all data and functionality.

How does CSRF function?

Three critical factors must be met in order for a Cross-site request forgery (CSRF) attack to be successful:

A relevant action. The attacker has a reason to cause an activity within the programme. This could be a privileged action (such as changing other users' permissions) or any action on user-specific data (such as changing the user's own password).
Cookie-based session handling. The activity entails making one or more HTTP requests, and the programme only uses session cookies to identify the user who made the requests. There is no other method for tracking sessions or validating user requests.
No unpredictable request parameters. The requests that carry out the action do not include any parameters whose values the attacker cannot deduce or predict. For example, while causing a user to change their password, the function is not vulnerable if an attacker knows the current password's value.

Assume an application includes a feature that allows the user to modify their email address on their account. When a user does this action, they send an HTTP request that looks like this:

POST /email/change HTTP/1.1

Host: example-website.com

Content-Type: application/x-www-form-urlencoded

Content-Length: 30

Cookie: session=yvkowsztyeQkDZzeQ5gAdFreyxHfsAfE

email=Lennie@user.com

This satisfies the CSRF requirements::

An attacker is interested in the action of changing the email address on a user's account. Following this operation, the attacker is usually able to force a password reset and gain complete control of the user's account.
A session cookie is used by the programme to determine which user made the request. There are no other systems or tokens in place to track user sessions.
The attacker can quickly identify the values of the request parameters required to carry out the action.

With these conditions met, the attacker can create a web page that contains the following HTML:

<html>

<body>

<form action="https://example-website.com/email/change" method="POST">

<input type="hidden" name="email" value="pwned@evil-user.net" />

</form>

<script>

document.forms[0].submit();

</script>

</body>

</html>

When a vulnerable user enters the attacker's website, the following occurs:

The attacker's page will cause an HTTP request to be sent to the vulnerable website.
If the user is logged in to the vulnerable website, their browser will include their session cookie in the request (assuming SameSite cookies are not utilised).
The vulnerable website will process the request normally, assuming it was made by the victim user, and changing their email address

Note

Although CSRF is commonly associated with cookie-based session handling, it can also occur in other circumstances where the programme adds certain user credentials to requests, such as HTTP Basic authentication and certificate-based authentication.

Defending against CSRF attacks

The most effective technique to prevent CSRF attacks is to include a CSRF token in relevant queries. The token should be as follows:

Unpredictable with large entropy, which is the case with session tokens in general.
Connected to the user's session.

Every case is rigorously evaluated before the required action is carried out.

Why Choose Indian Cyber Security Solutions (ICSS) ?

Indian Cyber Security Solutions is one of best institute of India among other institute in India. ICSS offer as CEHv11 Courses in India as well as kali Linux. ICSS has won as many award for giving the online training as well as offline training. Its way of giving the training is unique which is easily adapted by the student as well as the professional. Due to way how ICSS trained the student it has got as many award some of award are Tech Brand of 2020, Ten most trusting cyber security certification provider 2021 and many more.

Among the many Ethical Hacking course in India, Indian Cyber Security Solutions would be the right for you to join. We have the right set of practical lab classes set up for students to learn as well as industry grade trainers who would conduct the classes and impart the right set of Cyber Security Knowledge to students. Our efforts have been acknowledged by various reputed administrative institutes, such as "Top Ten Training Institutes in India in 2020” by Silicon India; as well as Ten Most Trusted Training & Cyber Security Certifications Provider, 2021 by The Knowledge Review.

We not only provide ethical hacking course, but also Machine learning, Java Programming, AWS Cloud Computing, Microsoft Azure, OSCP, CISSP, Networking and more. As these encompasses Cyber Security, we make sure that we provide a 360 view of Cyber Security courses.

As an Education Institute, we are also cyber security service provider to corporate organization. Services like VAPT, Web Penetration Testing, Network Penetration Testing, Mobile Application Penetration Testing to corporate organization like IRCTC, HDFC, Cambridge Technologies, and many more. With this, Indian Cyber Security Solutions have been acknowledged as the 20 Tech Brands of 2021. by Business Connect India.

Our Cyber Security Services

Cyber Security is extremely important for every organisation and that we understand that data theft avoided is better than data theft done. Thus we also provide cyber security services to various MNCs across India. Our team is professional in providing Web Application Penetration Testing, Network Penetration Testing, Mobile Application Penetration Testing to clients.

We this, we have been acknowledged as the top 20 most Cyber Security Trusted Brands for 2021 by The Global Hues. We stand by to our commitment in providing the right cyber security training to students. We have provided services to clients like Madhya Pradesh Gramin Bank, Odisha State Pollution Control Board, HDFC Life Insurance Corporation, Qatar Development Bank and many more.

Why not Enquire more about our Education Training and Corporate Services?