Cross Site Request Forgery Attacks

What is Csrf attack?

Cross-Site Request Forgery (CSRF):

Cross-Site Request Forgery (CSRF) is a serious attack in which malicious entity tricks a victim into performing actions on behalf of the attacker. The impact of the attack would depend on the permissions granted to that victim by the application. The actions which are performed by the attacker on the victim will surely have an effect if the victim performing the actions as an administrator level versus a low-level user, with fewer privileges. CSRF attacks always take advantage of the fact that an application completely trusts a particular user, once it can confirm that the user is whom they say they are.

There are two main parts to perform a Cross-Site Request Forgery (CSRF) attack, the first part is to trick the victim to click a link or loading up a page. The second part is to send a request in the victim’s browser, that will send a legitimate-looking request to the web application. The request will be sent along with the values that the attacker wants, including the Cookies that the victim was associated with that application. In this way, the application knows that this victim can perform actions on the website and any request sent with these HTTP credentials or Cookies, will be considered as a valid request, even if the victim sends the request on the attacker’s command.

So Cookie based authentication is the main problem of csrf attack. Csrf attack takes advantage of the fact that the browser automatically sends the cookie to the server with each and every request.

Tricking a victim into sending a POST request may be trickier than sending a GET request With the GET request. The attacker only wants that the victim should send a request that had all information in the URL of the get request, whereas POST requests require a body to be sent along with the request. Taking full advantage of javascript the attacker can move the victim to their own malicious website and loads the page of its own malicious website, the illegal POST request will be sent automatically to the victims' website from its browser by the attacker. The victim already logged in the cookie will be sent along with the request by the attacker.