Cross-Site Request Forgery Attack ?

In this article, we are telling you about the Cross-Site Request Forgery attack. We have already told you about the Cross-Site Request Forgery attack. You can also read our article if you want.

Here we are telling you how to do Cross-Site Request Forgery attack using different methods, here we are telling you by solving some labs.

All these labs are found on the website of portswigger, here you are not being told the principle. We have already told you about the Cross-Site Request Forgery attack using BWAPP earlier.

Note- This article is only for educational purpose. Don’t miss use your knowledge and skills.

Cross-Site Request Forgery Attack Labs ?

Apart from the labs mentioned here, you also get more labs of Cross-Site Request Forgery Attack, which you can try to solve by yourself, we do not tell you how to solve all labs so that you can try to solve labs yourself.

CSRF vulnerability with no defenses ?

First of all, to solve this lab you have to run the burp suite normally as you are told in all the articles how you can run the burp suite.

https://portswigger.net/web-security/csrf/lab-no-defenses

After running the burp suite normally you have to access the lab as you can see in the image here you get the username and password to login with lab as well.

After accessing lab you get the option to login on home page, you have to login there by giving username and password as you can see in the image, you have to do something similar.

What is file path traversal vulnerability

After login, you get the option of change email in this way, here you can send any email of your choice and click on update email as you can see in the image here.

After doing all this you will get a post request in http history in burp suite like you can see in the image here you will get the option to generate CSRF POC in the option of engagement tools by right clicking this request.

After it is open in front of you in this way, you have to go to the option and check the option of include auto -submit script. After doing all this, you have to click on regenerate, something like this Cross-Site Request Forgery Attack work Does

After doing all this, you have to go to the exploit server after copy html, in this way you have to give that format in that body, after doing all this, when you click on the store, you will be able to see your lab will be solved.

How to do os command injection attack

Here you can also check by exploiting the view, you will get to see the submit request button in this way and your lab will also solve this, it is the same as you have been told earlier in Bwapp.

CSRF where Referer validation depends on header being present

In the same way, you can also solve the second lab of Cross-Site Request Forgery Attack, here also first you have to do the same process as you have been told in the earlier lab, here also you have to request to change the email.

https://portswigger.net/web-security/csrf/lab-referer-validation-depends-on-header-being-present

Just like you got a post request in the burp suite’s http history on changing email in the previous lab, you get a post request here as well, as you can see in the image, you also get something similar.

Here you have to send this request to the repeater, there you have to change the url as you can see in the image, you get a response in this way by clicking the url.

What is oauth 2.0 authentication vulnerability

Here now if you remove the referer url, in such a way you get to see the response of 302 found as if you can see in the image, after doing all this, you have to send this request to generate the CSRF pass.

You have to add a line like this, here you have to do the same process as you have been told in the earlier lab as you can see in the image, you have to add this line in some way.

After doing all this, you have to copy html, after that you have to give that format in the body of the exploit server, after this you have to click on the store, you can check it by exploit the view.

After doing all this, you will be able to see that this lab of your Cross-Site Request Forgery Attack will be solved as if you can see that the message of congratulations is gone.

CSRF with broken Referer validation

In the same way, you get the third lab of Cross-Site Request Forgery Attack, here too first you have to process the same as you have to capture the request of email change in labs.

https://portswigger.net/web-security/csrf/lab-referer-validation-broken

After doing all this, you have to send that request to the repeater as mentioned in the previous lab, you also have to first change the referer url and send the request.

After doing all this, you have to change the referer url from the original domain as well as the request again and send the request again as you can see in the image.

What is web cache poisoning vulnerability

After doing all this, you have to send this request to the generate CSRF pass option and you have to do the same process and also you have to add a line like this.

After adding a line like this, you have to copy html and go to the exploit server and paste that format in the body, after doing this you have to click on the store.

After doing all this, if you want, you can see by exploiting the view, you will get to see the submit request button and this lab of your Cross-Site Request Forgery Attack will also be solved.

The Conclusion

I hope that now you can understand about these labs of Cross-Site Request Forgery Attack. We have told you about Cross-Site Request Forgery Attack before.

You must first read our article about Cross-Site Request Forgery Attack, then only you can understand these labs, we have tried to tell you here how we can find Cross-Site Request Forgery bug.

All this has been told to you for educational purpose, I hope that you will not use it in illegal way, here we have given you many such articles.

If you have any kind of problem in solving the labs of Cross-Site Request Forgery Attack and in such a way, you can ask in the comment as well as if you have any kind of question, you can still ask.

If you like this article about our Cross-Site Request Forgery Attack, then you must share it, here we have told you everything for free, you can also support us if you want.

Subscribe to our blog for latest updates

Sharing is Caring

Thankyou

Free Learning Tech