In this lecture we're going to have a look on NCIS or cross-site requests for Jerry these vulnerabilities
allow us to force a user to do things that they don't want to do.
For example once you log into a Web site let's take Facebook you'll be able to do certain things to
your profiles so you can upload pictures.
You can change your password you can change your information send messages and post stuff to your wall.
Now she SRF Ockers when the website doesn't validate if the user actually wants to do a certain task
so it doesn't check if the user actually intends to change their profile picture or to change their
password.
So if the website doesn't do that we'll be able to program a hasty e-mail page.
And if the user clicks it or runs it they'll be forced to carry out a certain task that we program it
to do for example we can get the user to change their password without them even knowing.
Let's have an example on how this happens and it will become more clear to you.
So I have my DVD Avenue here and I'm just going to log in with my username and password which is admen
and I'm going to put my password.
Now if we go to the C.R. I surfed up here you'll see that it allows us to change our our password.
So this is just like a normal control panel to a normal web site.
And usually when you log into your account one of the features that you can do is you can change your
password to a different password.
So from here I'm going to set my password to 2 2 2 2 2 2 and I'll say it in here as well the same password.
I'm going to hit enter.
And as you can see is telling us that the password has been changed.
So this is an example of a feature that the user can do to their account they can change their password
if the target web site which is DVD-Video doesn't check if the user actually wants to do this task.
Then we can create a page that is similar to this page.
And once the user runs that page they'll actually change their password without them even knowing.
Now there's a number of ways to analyze the connection and our lives the information sent between the
client and the target to make that SRF exploit.
I'm going to show you the easiest and most reliable way and it works regardless of the type of form
whether it's post or get.
So with this particular one it's actually really easy to exploit if you just send the or right here
to the target user.
And then if they're on it they're password will be changed.
But in more complicated ways sometimes you don't see that sometimes post is used.
So I'll show you the most reliable way to do this kind of attack.
So the first thing to do is right click the form that you want to hijack.
You were going to inspect the element and we're going to look to that where the forum is so we're going
to look at where is the start of the forum tag and the end of the forum tag.
I'm actually going the right clicking in here inside the forum.
And as you can see now we have the start of the forum is in here and it ends with a slash forum forward
slash forum.
And you can see it right here at the end.
So this is the part of the code that we're interested into this is the part of the code that we want
to modify and send to the target user so that when they run it they'll actually change their password
without them knowing.
So I'm going to Right-Click this and I'm going to edit as the e-mail and I'm going to copy everything
inside here so I'm going to do control I control See and that's copy it for me.
And then I'm going to go to my left page right here and I'm going to paste it and I'm going to save
this and we'll call it Yes or aftertaste him out
and I'll put this in the desktop and click on Save.
And that's it save.
Now if we let's just run this code at the start and see what we get.
So I have it right here on my desktop.
And I'm just going to click it.
And as you can see just get a page and a whole page that asks you for a new password and account to
confirm the password so you can see the form here is actually similar to the form that we want to hijack.
Now to get that page to work we need to modify a few things.
Now you can see here we have a form right here and the action is set to a hash tag so it actually doesn't
give a web site to submit this form to.
So the first thing you want to modify is you want to give it to the Web site to submit this form to
and this is going to be the same web site that we're on at the moment.
So I'm going to control copy this and I'm going to put it in here instead of the hashtag.
Now sometimes you'll actually if you're copying a form from a different website you might actually see
a name of a file so you'll just see a file name you want to make sure you have the full your URL to
the to the form.
Because if you just have a file name for example if you just have indexed that BHB it won't know where
that index that BHP is at now when it's on the Web site because it's already started on that Web site.
But when we're actually taking the file like this and storing it on our local machine you want to make
sure you have the full You are all and here so even if you see something instead of the hash tag for
using something like indexed that BHP or whatever.
Keep that in there but make sure you give it the full the or L that comes before that page.
So this is all good.
Now if I save this and if we run this we'll actually be able to change the password using this for now
the beautiful thing about these exploits.
You can actually confirm that it works for you first and then you can send it to the target's client
or to the Daggett's person so if we actually reset our password here so I'm going to set the password
2 3 3 3 3 3 3 and confirm it in here.
And then I'm going to do.
Hit enter.
You'll see that we get a message telling us that the password has been changed and we can actually now
log out and log in with the new password.
So this is good.
Now we have a forum that's actually not stored on the web site but using it we can actually go to that
Web site and change the password.
So this actually confirms that the target web site is vulnerable to see f because it's not validating
that the request is coming from the Web site itself.
So it's not validating if the user actually wants to do that.