Scribd
Upload
5 views

Understanding Cross-Site Request Forgery

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
5 views

Understanding Cross-Site Request Forgery

Uploaded by

Raihan Patel
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 9

CSRF

Introduction
⚫ Understanding the CSRF Vulnerability
⚫ Methodology
⚫ Impact
⚫ Mitigations
Pre-Requirements
⚫Cookies:- Cookies are arbitrary pieces of data, usually
chosen and first sent by the web server, and stored on
the client computer by the web browser
⚫Session ID :-session ID or session token is a piece of
data that is used in network communications to
identify a session, a series of related message
exchanges. Session identifiers become necessary in
cases where the communications infrastructure uses a
stateless protocol such as HTTP.
⚫SOP(Same-Origin Policy) :-In this policy, a web
browser permits scripts contained in a first web page to
access data in a second web page, but only if both web
pages have the same origin.
What is CSRF?
⚫Cross-Site Request Forgery (CSRF) is an attack that
forces an end user to execute unwanted actions on a
web application in which they’re currently
authenticated.(owasp)
⚫It allows an attacker to partly circumvent the same
origin policy, which is designed to prevent different
websites from interfering with each other.
CSRF Attacks
⚫CSRF is stand for Cross-Site Request Forgery.
⚫In a successful CSRF attack, the attacker causes the
victim user to carry out an action unintentionally.
How CSRF work?
⚫Related action

⚫Cookie-based session handling.

⚫No unpredictable request parameters.


Impact of CSRF
⚫After Successful CSRF attack, the user carry out an
malicious action behalf of attacker.
⚫While Changing the victim’s email address or
password.
⚫While Purchasing anything.
⚫Making a bank transaction.
⚫Explicitly logging out the user from his account
Mitigations
⚫Anti-CSRF tokens
⚫Same-Site cookies attributes
⚫Dont use GET requests for state-changing operations.
⚫CSP(Content Security Policies)
⚫Source Origin and One time Token

You might also like