In this lesson,
we're going to cover two different types
of Request Forgeries: Cross-Site Request Forgery or CSRF,
and Server-Side Request Forgery or SSRF.
A request forgery is a type of attack
where an attacker tricks a victim
into making an unwanted request.
These attacks exploit the trust a web application has
in a user's browser.
Let's start by discussing Cross-Site Request Forgery.
A Cross-Site Request Forgery or CSRF,
involves tricking a user into making a request
they did not intend.
Again, this type of attack takes advantage
of the trust that the web application
has in the user's browser.
The attacker crafts a request
that will be accepted by a web application
where the user is already authenticated.
When the user unknowingly executes this request,
the web application processes it
as if it were a legitimate,
performing actions on behalf of the user.
For example, an attacker
might embed a malicious link in a website.
If the user clicks the link
while logged into their social media account,
the attacker could post unauthorized content
on the user's profile.
A real world example
is a 2009 Twitter, now known as X, worm incident
called the "Mikeyy" worm.
The attacker exploited a vulnerability in Twitter
to embed malicious JavaScript code in tweets.
When the user view these affected tweets,
the script automatically spread the worm
by posting unauthorized tweets from their accounts.
Preventing CSRF attacks involves using anti-CSRF tokens.
These tokens are unique to each session
and are included in every request.
When a request is received,
the server checks for a token's presence and validity.
If the token is missing or incorrect,
the request is rejected.
Implementing the SameSite attribute
where cookies can also help mitigate CSRF attacks
by ensuring cookies are only sent
with requests initiated from the same site.
Requiring re-authentication
for critical transactions, like entering a password
or using two-factor authentication,
adds another layer of security.
Pentesters can use tools like Burp Suite
to perform CSRF attacks.
Burp Suite allows the creation and manipulation
of HTTP requests,
making it easy to generate CSRF attack vectors.
Now, let's discuss Server-Side Request Forgery or SSRF.
SSRF is an attack where the attacker tricks the server
into making requests to unintended locations.
This can be more dangerous than CSRF
because it can bypass firewalls
and access internal services
not directly exposed to the Internet.
For instance, an attacker might craft a request
to a web server
that includes a URL pointing to an internal system.
If the web server processes the request,
it might fetch and return sensitive internal information.
An example of SSRF could involve a web application
that fetches images from URLs provided by the users.
An attacker could input a URL
that points to an internal server,
potentially access sensitive data
or executing commands on that server.
A notable instance of SSRF
was seen in the Capital One breach,
where an SSRF vulnerability was exploited to gain access
to sensitive internal metadata services hosted on AWS.
Preventing SSRF attacks involves validating
and sanitizing all user inputs
that could be used to construct requests.
Implementing network-level controls,
such as firewalls and access control lists,
can limit the server's ability to make outbound requests
to untrusted locations.
Configuring the application to only allow requests
to a whitelist of trusted domains
can also further mitigate the risk.
Pentesters can use tools like OWASP Zed Attack Proxy
or ZAP, to find SSRF vulnerabilities.
ZAP allows the scanning and manipulation of HTTP requests,
making it a powerful tool for identifying
and exploiting SSRF flaws.
By using ZAP,
pentesters can test how a server handles outbound requests
and find weaknesses that could be exploited.
So, remember, when dealing with request forgeries,
always validate and sanitize inputs,
use anti-CSRF tokens for user actions,
implement network controls to restrict server requests
to trusted sources,
and consider re-authentication for sensitive transactions.
This ensures both the user's and server's integrity
and security are maintained,
protecting against unauthorized actions
and database breaches.