An Introduction to CSRF Vulnerabilities

What is a CSRF Attack?

A CSRF attack is a form of attack in which commands are transmitted from a victim to another website without the users consent. CSRF attacks are usually invisible and rely on browser functionality (such as automatically loading images).
How is a CSRF Attack Carried Out?

CSRF attacks are embedded in an element browsers automatically react to (such as an image tag).

Lets assume that Joe has just registered with a brand new Electronic Money transfer site. When Joe wants to transfer money, he heads to www.example.com/transfer.php to send some money to his wife, Mary.

He fills out the forms for the amount of money he wants to transfer and who he wants to send the money to, and then clicks submit. The URL now looks like this:
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Joe&to=Mary&amount=2
__________________________________________________________________________

The next day, Janice, Joes angry ex-wife, also registers with the site. She decides to send $5 to her boyfriend, named Sam. She heads to www.example.com/transfer.php, fills out the forms (quite angrily), and hits submit.

She notices that the URL,
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Janice&to=Sam&amount=5
__________________________________________________________________________

does not require any authorization besides her Session cookie (which is automatically send to the web server).

Still bitter over what she thinks was an unfair settlement to her divorce with Joe, she slips on her black hat and decides to cheat Joe out of his money.

She sends a message to Joe which looks like this:

CODE :
__________________________________________________________________________
//Title: I Hate You!!!!

You are the most rotten, vile, PIG ever!!!!!
[img]www.example.com/transfer.php?from=Joe&to=Janice&amount=5000[/img]
__________________________________________________________________________

(Note that Janice used BBCode for her image tag, which example.com automatically translates into HTML.)

Later that day, Joe logs on and views the message. His browser sees the image tag and automatically follows it to
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Joe&to=Janice&amount=5000
__________________________________________________________________________

His browser then attempts to download the page and display it as an image. Because the link provided is not a valid image, the browser displays it as a broken image.

However, the server at example.com sees that Joe has visited the link, and transfers $5000 dollars to Janice.

All this happens invisibly and within seconds.
Dangers of CSRF

We now understand how a CSRF attack is performed. But, what can this attack do?

It can:

*Transfer Funds
*Log a user in/out
*Register a user
*Log data of a user
*Send a message from the victim to someone else
*Etc

The only requirement is that the server must not have a means of detecting if the user has authorized the action that a CSRF attack performs.
Prevention of CSRF Attacks

CSRF attacks can be prevented in a number of ways, but the best way to prevent them is a combination of many different methods.

CSRF attacks are much easier if an action can be performed with an HTTP GET request, but simply having only POST requests is not sufficient to prevent CSRF attacks.

One common method of preventing CSRF attacks is to have a hidden value randomly generated upon the users visit of the webpage. The advantage of this strategy is that the attacker can not predict what the token will be, and thus cannot conduct the attack. This would look something like
CODE :
__________________________________________________________________________
//

__________________________________________________________________________

Randomizing the name of the CSRF token provides additional security.

Another method of prevention is double-submitting cookies. This is when you send the session ID in two ways: once in the cookie and once in a hidden value.

The session ID must be generated randomly and be required for the action to be performed.

Other general protection methods include:

*Not keeping users logged in for a long time
*Client-side, a browser should only follow image tags that end in image types such as jpeg, gif, png, etc.
Conclusion

In conclusion, CSRF attacks are based on a client's trust in a browser. They are performed when a user's browser sends an HTTP request to a site that causes a 'side effect' without the user knowing.

Please note that while CSRF attacks commonly are included in image tags, they are not limited to one html element. There are multiple ways to exploit a CSRF vulnerability.

Get Your Hacking Videos Here!

Well not here as in the SynJunkie blog but here, as in the Learn Security Online site. The guys over at LSO have revamped the site and it's looking pretty sweet.



Whenever I have a few minutes spare I love to watch how some of the experts out there attack systems and use the tools that projects such as BackTrack and Metasploit make available to us. Or if I am learning something new it's great to see a demonstration of a tool or process. So the guys over at LSO have done all the hard work for us and linked to them all. As well as all of there own vidoes there are links to over 80 non-LSO videos.

So if you want to see how the experts perform SQL Injection or run the latest MetaSploit exploits then check out the video section at Learn Security Online.

Basic Vulnerability Scanning With Nessus

I would like to preface this entry by stating that vulnerability scanning is not a penetration test. It is merely one part of a test and should be combined with other forms of activity to result in a thorough examination of all vulnerabilities, whether they be human, policy or technical.


About Nessus

Nessus is the worlds most popular open source vulnerability scanner. Nessus is available for Windows or Linux. The version i will be using throughout this blog entry will Nessus 3 running in Ubuntu. Nessus uses a Client Server model.

Nessus Server
The Nessus server is called nessusd. The server does not have to be on the same computer as the Nessus Client and communications between the server and client can be encrypted.


Nessus Client
The Nessus Client i will be using is called NessusClient. Below is a screenshot of the NessusClient interface.



Nessus consists of the following:

Plugins
plugins are checks for vulerabilities that Nessus performs. The plugins database can be updated using the following command.
/opt/nessus/sbin/nessus-update-plugins

Unless you have a paid subscription to Nessus you will only recieve plugins that are older than 7 days. Plugins can be written using the Nessus scripting language NASL. Update the plugins before starting the nessusd server.

Tasks
A task is created to hold duties. a task can be something such as Weekly Checks or Unauthorised Program Scan etc....

Scopes
Scopes represent connections to the Nessus Server (nessusd) are part of a task. Scopes contain lists of hosts (Targets) to scan and tasks can hold many scopes such as Web Servers, File Servers or VNC Hosts etc...

Targets
Targets are hosts or lists of hosts. These can be entered in as fully qualified domain names, IP addresses or IP ranges.


Getting Nessus Up and Running

Installation
1. Download and install Nessus 3. you will need the NessusClient package also. The packages are available at www.nessus.org
2. Once installed update the plugins using /opt/nessus/sbin/nessus-update-plugins

Setting Up
1. Start nessusd from /opt/nessus/sbin/nessusd
2. Start NessusClient from /usr/bin/NessusClient
3. Log into the Nessus Client with the account credentials created during the installation.


Using Nessus

In the example below i will perform a targeted audit of web Servers in my home lab.

I first used NMAP to find alive hosts using:

nmap -sL 192.168.1.1/24

This turned up 2 hosts (shown below).




I then use NMAP to determine if any of the 2 hosts found are listening on port 80 using:

nmap -sV -p80 192.168.1.10,20




In a pentest i would look for Web Servers on non-standard ports such as 8080 8008 or 81 also.

Now i have found a web server and from looking at the version i see it's IIS 6.0 i turn to Nessus.

After firing up Nessus i configure the following options.

1. Select Global Settings and click the connect icon. This will allow me to alter the global configuration and give me access to the plugins. These global settings can be changed and will form the default settings for new tasks.

2. I create a new Task called "Web Servers" and a scope called "IIS Servers"

3. Within the scope i set my target as 192.168.1.10

3. As in this example I'm only going to scan for IIS Vulnerabilities i set my filter for "IIS" on Name and Description and then select Enable All Plugins. This just enables the plugins related to IIS. details of plugins can be viewed by double clicking on a particular plugin.



4. After executing the Scan within Nessus Client, Nessus will perform a portscan of my target and then scan for vulnerabilities.

5. Following the scan i check out the report that Nessus produces and look for any vulnerabilities that may have been found.



The test above is a basic description of a vulnerability scan of a IIS web server to familierise you with Nessus. If you are serious about scanning for vulnerabities you will need to explore the Interface and adjust the various option for your scan

In another example rather than targeting a particular service i have opted to scan use all vulnerability checks (plugins). Although this is particularly noisy and has a better chance of finding a vulnerability it may crash services so use with caution.



This scan found a few vulnerabilities, one being a vulnerability in the server service that has not been patched (ms06-035). If i wanted to exploit this vulnerability the next step i would perform would be to find a working exploit for this platform. After a few minutes of searching i find an exploit at www.milw0rm.com/exploits/2057


Addition Options

When setting the options, either globally or for a particular scan, you can set the following:

• Provide a username and password for the target.
• Not to scan fragile devices (printers)
• Global variables (CGI Scanning, network types, reports, logs, debugging)
• Http login credentials
• Login configurations (FTP, NNTP, HTTP, POP2, POP3, IMAP, SMB)
• Nessus scanner options
• Oracle settings
• Ping options
• Services (SSL options, number of connections, timouts)
• SMB Enumeration options
• SNMP options

Nessus Knowledge Base

by using the Nessus Knowledge Base Nessus will provide various options to remember previous findings from scans and utilise that information in future scans


Further Reading

• http://www.nessus.org/documentation/