Naylor__ 1 What is a CSRF vulnerability ? CSRF is an abbreviation which means Cross-Site Request Forgery, it is also called Sea-Surfing but also often XSRF. This is a web authentication vulnerability. This technique benefits from the trust of Web applications to its customers. The goal is to force the victim's browser to send an HTTP request without the knowledge of this user who is logged into his account (the session must be active). It will exploit this authentication and will allow to execute actions in a completely transparent way. How to exploit ? [hide] When you send a HTTP request the url look like : www.victim.com/transfer.php?from=Unknown&to=Someone&amount=100 this is the normal request When "Unknown" send 100 units to "Someone" . To exploit this vulnerability the Unknown's sessions must be active on the website, then send him the same url. when he will click on it, the target website will send 100 unit again to "Someone". but if you hide the url with BBcode like that : (if you have an error it's normal the www.victim.com website doesn't exist) ImageCool.jpghe he will believe that he's opening a image but in reality you can see that, If you click on this link you will see that the url is www.victim.com/transfer.php?from=Unknown&to=Someone&amount=100 so the "Unknown" one will send without knowing 100 unit to "Someone" Because the url will say to the www.victim.com website to send 100 units to "Someone"that work only if the victim.com session of "Unknown" is open because if not, no website will understand the request. (in general session keep open because of cookies) [/hide] Leave a like https://forum.exploit-zone.eu/uploads/emoticons/biggrin.png[/img] LEECHER DIE IN HELL :pepegun: Quote Share this post Link to post Share on other sites
Erblin0303 0 can you make a tutorial sniffing private api broo Quote Share this post Link to post Share on other sites
Naylor__ 1 can you make a tutorial sniffing private api broo yes why not, i will make a second tuto on the csrf vulnerabilty, where we're gonna build a code to exploit automatically a csrf vuln on your website and anonymously Quote Share this post Link to post Share on other sites
