OWASP Other possibilities: If there is CSRF vulnerability in admin panel of a website, whole website can be compromised! Hijacking primary DNS server setting of your router! -> phishing, mitm etc.! …Add more! Want to see it work? Visit superlogout.com Read More at OWASP CSRF Cheat Sheets, Just Google it! 9
OWASP CSRF Protector Project Project Leader Abbas Naderi Primary Contributor that’s me! Project Mentors Kevin W. Wall & Jim Manico Other Contributors Abhinav Dahiya 10
OWASP CSRF Protector Project 11 A new anti-CSRF method to protect web applications! It has two parts for now: A standalone php library An Apache 2.x.x module
… web application logic … Server Side Interceptor / Input Filter Output Filter Request from client Response to client
OWASP Has token in cookie (C) Has token in request (T) C == T Allow the request, Generate another Pseudo Random token & send it back to client! Take Action as per configuration: Send back a 403 Send back a 404 Show a custom error message Redirect user to a custom URL Strip all request arguments and allow the request Yes No BACK Server Side Interceptor / Input Filter
Correctness of the design Scripts running on attacker’s website cannot retrieve token from other websites, because of Same Origin Policy of browsers! Attacker cannot use his token to authenticate requests in other websites. Attacker cannot guess tokens based on ones he has as each time a new pseudo random token is generated for each request (& each user). And PRNG in reseeded after every 10000 requests! 18
20 Standalone library for CSRF Mitigation in php based applications. Can be easily integrated with existing web applications or can be used while developing new ones. Features: 1.Highly customisable! 2.Supports POST / GET requests! 3.Easy to alter according to your needs! 4.Works well with all php versions > 5.0
OWASP It can be easily installed on apache 2.2 servers! Its distributed as a shared object file! Easy to configure, by modifying fields in httpd.conf file (Apache’s configuration file) Developer doesn’t need to make any changes to its web applications, so even server administrator can implement this in their servers. Has currently been tested with Linux (Ubuntu) and OS X only!
OWASP 24 Supports AJAX & dynamic forms 2 We also have custom wrappers in JS that ensures that our injected token doesn’t creates any conflict when developer designed logic for form validation functions! We support the old attachEvent() & ActiveObject() methods that exist in IE ( <= 6.0)
OWASP A better option for apps that support plugins 4 For example wordpress!
OWASP Roadmaps? Apache 2.2 module that works with windows system! Automated testing (Continuous Integration) for Apache module! Support for legitimate cross-domain requests! 27