Shulou(Shulou.com)06/01 Report--

This article introduces you how to analyze CSRF loopholes, the content is very detailed, interested friends can refer to, hope to be helpful to you.

CSRF: cross-site requests are forged and disguised as user identities to perform some malicious and illegal operations that are not voluntary by the user.

The difference between CSRF and XSS:

1. CSRF needs to be operated after login, but not for XSS.

2. CSRF requests trusted websites by pretending to be trusted users

Environment: BWAPP

2. Log in. The default account number is bee and the password is bug.

3. From the page in csrf, change the password to 1111.

IV. Analysis of url

Http://192.168.1.119/bwapp/csrf_1.php?password_new=1111&password_conf=1111&action=change

Log out of the account and log in again. The password has been changed to 1111.

6. Renovate and modify url, and visit this address directly

Http://192.168.1.119/bwapp/csrf_1.php?password_new=2222&password_conf=2222&action=change

The password was reset to 2222

VII. Covert utilization

1. Create a new html page, modify the url address and add it to the src attribute under the img tag.

Oh, not bad. Long time no see

2. Access the html, automatically access the modified url, and change the password automatically.

On how to analyze CSRF vulnerabilities to share here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.