1. AppSec USA 2014 Denver, Colorado CSRF 101 Introduction to Cross-Site Request Forgery

2. Introduction { “Name” : “Danny Chrastil”, “Title” : “Senior Security Consultant”, “Company” : “HP Fortify”, “Hobbies” : [ { “hobby” : “Python Scripting Junkie” }, { “hobby” : “OpenSource Intelligence Advocate” }, { “hobby” : “BeeKeeping” } ] }

3. What is CSRF?

4. CSRF Misfortunes Misunderstood by many Testers Difficult for Developers Often incorrectly defended Sounds like fun! … eh? What is CSRF?

5. “Cross-site Request Forgery is a vulnerability in a website that allows attackers to force victims to perform security-sensitive actions on the Internet without their knowledge.” How do we define CSRF? - Daniel Miessler

6. An Example CSRF Evil Site Evil Request Normal Request / Response Normal Request Evil Response

7. HTTP is a session-less protocol Applications use cookies Cookies sent with every request All cookies are sent for the domain What makes CSRF possible? *** Requests come from the USER! ***

8. An Example CSRF Evil Site Evil Request Normal Request / Response Normal Request Evil Response Cookie: sessionid=dIG4nCMP7Ffq4MhmbQXHZrCY1

9. Force the user to logout http://x.x.x.x/csrf1/index.php CSRF Exercise #1

10. GET Requests – POST Requests – Hidden HTML form Other – Javascript / AJAX Calls Other Attack Vectors

11. Create an Admin user http://x.x.x.x/csrf2/index.php CSRF Exercise #2

12. Right way – CSRF Token outside HTML headers – Unique to each session / request – Double submit cookies Wrong way – CSRF Token inside HTML headers – Multiple step requests – POST only requests Defenses

13. Wrap it up! – CSRF requests come from the USER – Check all sensitive request for CSRF – Are defenses setup properly? Conclusion