Shulou(Shulou.com)06/01 Report--

First, what is CSRF:

As shown in the figure:

1. Users normally visit websites with CSRF vulnerabilities through browsers.

If I go to visit http://127.0.0.1:8080/DVWA/login.php

We log in to the account: admin password is: password, find a place to change the password

Change the password to 123456, and the modified url is:

Http://127.0.0.1:8080/DVWA/vulnerabilities/csrf/password_new=123456&password_conf=123456&Change=Change#

2. We construct a malicious website B to save the code as index.html

This is a malicious web page.

We visit the website B: click *

We can see that the password has been changed (changed to password)

Defense:

1. Try to use POST and limit GET

two。 Browser Cookie policy

3.Anti CSRF Token

Official account of Wechat:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.