How to resolve CSRF vulnerabilities
This article introduces you how to analyze CSRF loopholes, the content is very detailed, interested friends can refer to, hope to be helpful to you.
CSRF: cross-site requests are forged and disguised as user identities to perform some malicious and illegal operations that are not voluntary by the user.
The difference between CSRF and XSS:
1. CSRF needs to be operated after login, but not for XSS.
2. CSRF requests trusted websites by pretending to be trusted users
Environment: BWAPP
2. Log in. The default account number is bee and the password is bug.
3. From the page in csrf, change the password to 1111.
IV. Analysis of url
Http://192.168.1.119/bwapp/csrf_1.php?password_new=1111&password_conf=1111&action=change
Log out of the account and log in again. The password has been changed to 1111.
6. Renovate and modify url, and visit this address directly
Http://192.168.1.119/bwapp/csrf_1.php?password_new=2222&password_conf=2222&action=change
The password was reset to 2222
VII. Covert utilization
1. Create a new html page, modify the url address and add it to the src attribute under the img tag.
Oh, not bad. Long time no see
2. Access the html, automatically access the modified url, and change the password automatically.
On how to analyze CSRF vulnerabilities to share here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.
