Cross site request forgery csrf attack lab answer

SOPH LAB IN APPLIED COMPUTING

Find six vulnerabilities in CandyPal
Vulnerabilities must fall under the risks discussed during lecture
Cross-Site Scripting
Cross-Site Request Forgery
Insecure Deserialization
Using Components with Known Vulnerabilities
Unvalidated Redirects and Forwards
Insufficient Logging & Monitoring
Provide the following per vulnerability:
Name
Image

Description

Quiz

Quiz – Answers

Q1. What does OWASP stand for?

A1. Open Web Application Security Project

Q2. Which of the OWASP Top 10 was removed from 2017’s list?

A2. Cross-Site Request Forgery

Q3. What is Session Fixation an example of?

A3. Broken Authentication

Q4. DTD stands for Document Type Description.

A4. False

Q5. There is more than one type of injection attack.

A5. True

OWASP Top 10

OWASP Top 10 – Risks

Injection

Broken Authentication

Sensitive Data Exposure

XML External Entities

Broken Access Control

Security Misconfiguration

Cross-Site Scripting

Cross-Site Request Forgery

Insecure Deserialization

Using Components with Known Vulnerabilities

Unvalidated Redirects and Forwards

Insufficient Logging & Monitoring

OWASP Top 10 – Cross-Site Scripting (Overview)

When an attacker gets their JavaScript to execute on a victim’s browser

OWASP Top 10 – Cross-Site Scripting (Examples)

Reflected XSS – Payload in HTTP request comes back in HTTP response body

Stored XSS – Payload is stored in the application’s database and returned in an HTTP response body

DOM-Based XSS – Normal JavaScript comes from the HTTP response body and retrieves the payload from the URL to place on the page

OWASP Top 10 – Cross-Site Scripting (Labs)

URL: http://10.15.1.10:8081

Lab 1 – Reflected XSS

Lab 2 – Stored XSS

Lab 3 – DOM-Based XSS (Try Different Browsers)

Lab 4 – XSS in Tag Attributes

Lab 5 – POST XSS

Discussion – Remediation

OWASP Top 10 – Cross-Site Request Forgery (Overview)

When an attacker gets a victim’s browser to perform an action with their session

OWASP Top 10 – Cross-Site Request Forgery (Examples)

Victim is logged into an application

Attacker sends an email containing a link to victim

Link leads to the application’s logout endpoint

Victim clicks on the link and gets logged out

OWASP Top 10 – Cross-Site Request Forgery (Labs)

URL: http://10.15.1.10:8081

Lab 1 – CSRF to XSS Chained Attack

Discussion – Remediation

Discussion – SOP & CORS

Lab 2 – Steal Comments

OWASP Top 10 – Insecure Deserialization (Overview)

Serialization is the process of converting an object into a format that can be stored or transferred

Deserialization is the process of converting serialized data back into an object

Insecure Deserialization occurs when untrusted input gets deserialized

OWASP Top 10 – Insecure Deserialization (Examples)

Application A serializes objects and sends them to Application B

Application B does not authenticate Application A

An attacker makes direct requests to Application B with serialized data

Attacker’s serialized data gets deserialized and the object’s functions are executed

OWASP Top 10 – Insecure Deserialization (Labs)

URL: http://10.15.1.10:8081

Lab 1 – PHP Object Injection

Discussion – Remediation

OWASP Top 10 – Using Components with Known Vulnerabilities (Overview)

Self explanatory

Just because an application is using a component with known vulnerabilities does not mean it is exploitable

OWASP Top 10 – Using Components with Known Vulnerabilities (Examples)

https://nvd.nist.gov/

https://jeremylong.github.io/DependencyCheck/

https://dependencytrack.org/

OWASP Top 10 – Unvalidated Redirects and Forwards (Overview)

Redirect is when someone sends you elsewhere for an answer

Forward is when someone answers you after asking elsewhere

Rest is self explanatory

OWASP Top 10 – Unvalidated Redirects and Forwards (Examples)

An attacker borrows the reputation of a trusted domain to then send a victim somewhere malicious

An attacker gets an application to retrieve resources from a malicious server to achieve XSS

An attacker gets an application to communicate with a malicious server to steal credentials

OWASP Top 10 – Unvalidated Redirects and Forwards (Labs)

URL: http://10.15.1.10:8081

Lab 1 – Unvalidated Redirect

Lab 2 – Server Side Request Forgery (Credentials)

Lab 3 – Server Side Request Forgery (XSS)

Discussion – Remediation

OWASP Top 10 – Insufficient Logging & Monitoring (Overview)

Self explanatory

OWASP Top 10 – Insufficient Logging & Monitoring (Examples)

Users authenticating

Impersonation functionality

Payment functionality

Password reset functionality

Brute force attempts

Malicious traffic

Etc.

Next Week

Next Week

Topic:

Security Training Platforms Pt. 1

Assignments:

Week 4 Homework

Week 4 Quiz