Cross-site request forgery

Cross-site request forgery (CSRF) is an attack, where the user
is tricked to perform a malicious action with his authority and
credentials. The attack itself can be said to exploit the server’s
trust on the user.
Real-world cases of CRSF attacks have been known to be used
against very popular services such as Gmail, Facebook and
Amazon. The attack against Gmail allowed the attacker to get
a copy for all the emails received by the victim. a


Attack Strategies
CSRF is a form of confused deputy attack where the browser is
the confused deputy. A popular way of executing a CSRF attack
is by using a HTML image tag, or submit a form using
JavaScript. The attacker embeds this, for example, into a
website which will make the user perform a web request
according to the attacker’s liking.
A target site, a victim user, and a malicious site are the three
actors involved in the CSRF attack (see figure 1). The victim
visits the malicious site while he holds an active session with
the target site at the same time. Following is an example of
the sequence of steps in a CSRF attack.
1. After logging in into the target website, the victim user
gets authenticated starting a new session.
2. The session identifier for the session is stored in a cookie in
the victim’s web browser.
3. The malicious site is visited by the victim.
4. The malicious site makes the victim send a request to the
target website.
5. The session cookie is attached to the malicious request
automatically because the request is sent to the target site.
The malicious forged request is then catered to by the
target website.

Our Protocol to Detect CSRF :

CSRF Flaw Detection
We have developed a Python application for detecting CSRF
vulnerabilities in HTML forms. The working of the tool is
explained below.
Following algorithm can be used to detect CSRF vulnerabilities
(figure 2):
1. Create two user sessions: one for the “attacker”, one for
the “victim”.
2. Retrieve a page from the website that is being tested (the
“target” site).
3. If there is a form: build a request out of it, using the
attacker’s session.
4. Send the request with the victim user’s session.
5. If the request succeeds, we have found a CSRF flaw!