Cross-Site Request Forgery Attacks Research Articles

Automate the verification of session cookie attributes

In this research, we focus on a critical web security topic, namely the security of session cookies, which play a key role in the functioning of modern web applications. As a standard mechanism for storing data on the client side, cookies are crucial for authentication, authorization and maintaining the state of a user's session. However, despite their necessity and convenience, cookies can also pose serious security risks. Our research focuses on the analysis and automation of cookie attribute verification, which is critical to ensuring protection against various web attacks. Identifying and eliminating weaknesses in cookie attributes can significantly reduce the risk of malicious attacks such as session hijacking, cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. We take an in-depth look at modern methods and tools for securing cookies, including implementing strict policies on cookie attributes such as Secure, HttpOnly, and SameSite. These attributes help to restrict access to cookies from unauthorized use via client-side scripts and provide additional protection against cross-site attacks. In addition, we consider the importance of updating the cookie standard, RFC6265bis, which offers improved security mechanisms, including the SameSite attribute, which allows controlling the sending of cookies during cross-requests, thereby reducing the risk of CSRF attacks. Our research also includes an analysis of potential threats and vulnerabilities associated with the misuse or misconfiguration of cookies, as well as a discussion of strategies to minimize these risks. We demonstrate how detailed automated verification of cookie attributes can significantly improve the security of web applications. The results of the study point to the need to constantly monitor and evaluate the protection of session cookies, as well as the importance of implementing security best practices and standards to ensure the reliability and security of web applications.

Machine Learning for Web Vulnerability Detection: The Case of Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerabilities pose a significant threat to web application security, enabling attackers to execute unauthorized actions on behalf of authenticated users. Conventional CSRF detection methods, such as manual code review and static analysis, are often time-consuming, error-prone, and inefficient. Proposes Mitch, a novel machine learning (ML)-based solution for the black-box detection of CSRF vulnerabilities. Mitch employs supervised learning, trained on a comprehensive dataset of HTTP requests and responses, to effectively identify security-sensitive HTTP requests and uncover CSRF vulnerabilities within them. Rigorous evaluations on a diverse set of real-world web applications demonstrate Mitch's remarkable ability to detect CSRF vulnerabilities with high accuracy, outperforming traditional methods. Mitch's automated nature eliminates the need for manual code review and static analysis, saving time and effort while reducing the risk of human error. Additionally, Mitch's scalability allows seamless integration into continuous integration and continuous delivery (CI/CD) pipelines, enabling continuous security monitoring and vulnerability detection. Mitch's efficacy extends beyond detecting known CSRF vulnerabilities. Its ability to identify patterns and relationships enables it to uncover obscure CSRF vulnerabilities that may have been overlooked by traditional methods, including zero-day vulnerabilities. In conclusion, Mitch emerges as a powerful tool for enhancing web application security, offering a comprehensive and automated solution for detecting CSRF vulnerabilities. Its ability to handle complex web applications, uncover hidden CSRF vulnerabilities, and integrate into CI/CD pipelines makes it an indispensable tool for web security professionals. Mitch's adoption has the potential to significantly reduce the risk of CSRF attacks and safeguard sensitive user data. We propose a methodology to leverage machine learning (ML) for the detection of web application vulnerabilities. We use it in the design of Mitch, the first ML solution for the black-box detection of cross-site request forgery vulnerabilities. Finally, we show the effectiveness of Mitch on real software. In this project, we propose a methodology to leverage Machine Learning (ML) for the detection of web application vulnerabilities. Web applications are particularly challenging to analyses, due to their diversity and the widespread adoption of custom programming practices. ML is thus very helpful for web application security it can take advantage of manually labeled data to bring the human understanding of the web application semantics into automated analysis toolsMitch allowed us to identify 35 new CSRFs on 20 major websites and 3 new CSRFs on production software. Keywords: Mitch, CSRF, CI/CD pipelines, Security Token Service (STS), Same-Origin Policy (SOP).

An Enhanced Mechanism for Protecting Web Applications from Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is considered one of the top vulnerabilities in today’s web, where an untrusted website can force the user browser to send an unauthorized valid request to the trusted site. Legitimate users will lose their integrity over the website when the CSRF takes place. So far, many solutions have been proposed for the CSRF attacks such as the referrer HTTP header, custom HTTP header, origin header, client site proxy, a browser plug-in, and random token validation, but in this research, the use of random token validation to solve the problem of CSRF attacks was implemented. The proposed solution in the study used a concept known as Nonce which is a type of random token attached to requests sent over a server. This solution proved to be effective enough to protect and prevent web applications from CSRF attacks. Although no system can be secured against attacks, this study recommends that the random token validation (Nonce) approach of protecting web applications should be adopted by all web applications developers and users to improve on the already established solutions to reduce the chances of attacks on web applications to a very slim percentage, if not eliminated.

Study of Cross-Site Request Forgery on Web-Based Application: Exploitations and Preventions

Cross-Site Request Forgery (CSRF) is a prominent web exploit that continues to pose significant security risks, even on highly ranked websites. This research focuses on identifying the underlying vulnerability, understanding the techniques employed, and proposing effective preventive measures. The hybrid method which is systematic report review method and lab-based scenarios method is conducted to identify CSRF exploitation and prevention mechanisms. Using a scenario-based testing approach, this study investigated the cause and effect of CSRF attacks, uncovering numerous techniques for exploiting this vulnerability. Based on the report review, 35 CSRF vulnerability reports from the Hacker one Bug Bounty Platform are analyzed. The result shows there is a lack of awareness and implementation of primary defenses, resulting in a high violation of end-user data integrity. The result also extensively describes some of the profound causes and effects of CSRF attacks and uncovers a broad range of techniques for exploiting this vulnerability. Furthermore, this study provides actionable recommendations to enhance system security and raise awareness among developers and users. The findings from this research serve as a valuable resource for improving security practices and mitigating CSRF attacks.

DJANGO AS SECURE WEB-FRAMEWORK IN PRACTICE

. Today information security has become one of the most important parts of our social media life. Social and media resources are based on web-services in the cloud. It means security of web-services is the equality of people’s social, media, data and information security. In this paper the most important focus was on special secure techniques and tools inside the most popular web-framework on Python programming language - Django. Django has several really strong design patterns and techniques with special tools to store and send user’s data in very secure methods. Developer can easily install in Django-application some new extra instruments, tools and special libraries to make web-application more securable. Django has such extremely useful instruments like Django-ORM, CSRF-tokens, XSS-protection and so many else. For example, Django-ORM (Object-Relational Mapping) is a really powerful instrument to be used for protection of such attacks like SQL-injections. One more instance, CSRF-token (Cross-site request forgery - token) is really amazing internal Django's tool against cross-site request forgery attacks that Django uses in html-templates. The best practice and good examples of these tools are shown inside this paper. Moreover, in the paper were demonstrated comparison of different attack cases and their deep analysis with protection methods from these attacks by Django's tools and techniques. One more thing, we also briefly reviewed other types of vulnerabilities and methods of protection against them and hope this article has given an understanding of the Django security techniques. Finally, Django could become more securable after each next version.

Preventive Measures for Cross Site Request Forgery Attacks on Web-based Applications

Today’s contemporary business world has incorporated Web Services and Web Applications in its core of operating cycle nowadays and security plays a major role in the amalgamation of such services and applications with the business needs worldwide. OWASP (Open Web Application Security Project) states that the effectiveness of security mechanisms in a Web Application can be estimated by evaluating the degree of vulnerability against any of the nominated top ten vulnerabilities, nominated by the OWASP. This paper sheds light on a number of existing tools that can be used to test for the CSRF vulnerability. The main objective of the research is to identify the available solutions to prevent CSRF attacks. By analyzing the techniques employed in each of the solutions, the optimal tool can be identified. Tests against the exploitation of the vulnerabilities were conducted after implementing the solutions into the web application to check the efficacy of each of the solutions. The research also proposes a combined solution that integrates the passing of an unpredictable token through a hidden field and validating it on the server side with the passing of token through URL.

Information Security Controls against Cross-Site Request Forgery Attacks on Software Applications of Automated Systems

This paper presents statistical results and their consolidation, which were received in the study into security of various web-application against cross-site request forgery attacks. Some of the results were received in the study carried out within the framework of certification for compliance with information security requirements. The paper provides the results of consolidating information about the attack and protection measures, which are currently used by the developers of web-applications. It specifies results of the study, which demonstrate various distribution types: distribution of identified vulnerabilities as per the developer type (Russian and foreign), distribution of the security measures used in web-applications, distribution of the identified vulnerabilities as per the programming languages, data on the number of security measures that are used in the studied web-applications. The results of the study show that in most cases the developers of web-applications do not pay due attention to protection against cross-site request forgery attacks. The authors give recommendations to the developers that are planning to undergo a certification process for their software applications.

Исследование атак типа «Cross-Site Request Forgery» в рамках проведения анализа уязвимостей веб-приложений

Nowadays, web applications are one of the most popular types of target of evaluation within the framework of the information security certification. The relevance of the study of web applications vulnerabilities during information security certification is due to the fact that web technologies are actively used while producing modern information systems, including information systems critical from the information security point of view, and on the other hand carrying out basic attacks on such information systems do not require violators of high technical competence, since data on typical vulnerabilities and attacks, including the attacking tools are heavily represented in publicly available sources of information, and the information systems themselves are usually available from public communication networks. The paper presents the results of a study of the security of web applications that are target of evaluation within the framework of certification for information security requirements against cross-site requests forgery attacks. The results of systematization and generalization of information about the cross-site requests forgery attacks and security controls used by web application developers are presented. The results of experimental studies of 10 web applications that have passed certification tests against information security requirements are presented. The results of experimental studies have shown that most developers do not pay enough attention to protection from cross-site request forgery attack - 7 out of 10 web applications tested have been vulnerable to this type of attack. Based on the results of processing the results of experimental studies, the distribution of security controls used in web applications and identified vulnerabilities by programming languages were obtained. Recommendations regarding the protection of web applications against cross-site request forgery attack for developers planning to certify their software are formulated.

Preventing Cloud Attacks using Bio-Metric Authentication in Cloud Computing

Objectives: To provide a secured and efficient solution for end users to access their personal files in the cloud servers using biometric authentication. Methods/: In this Minutiae Map (MM) algorithm is implemented for processing fingerprint based authentication. The user personal files are stored in free public multiple cloud storages namely Dropbox and CloudMe using splitting and merging techniques. RC4 algorithm is used to improve the security in cloud environment. Cross site request forgery (CSRF) and Cross site scripting (XSS) prevention techniques are used to provide security against cloud attacks. Findings: This study analyses that MM algorithm is the best accurate fingerprint feature extraction algorithm compared to Orientation Map, Gabor Filter and core point detection techniques. The proposed approach measures the user personal files upload time in cloud servers namely Dropbox and CloudMe. The study also analyses the presence of CSRF and XSS attacks in the application. Applications/ Improvements: The proposed system can be improvised involving preventive measures for more security threats and integrating other biometric authentications.

SECSIX: security engine for CSRF, SQL injection and XSS attacks

With the increase in human-web interaction, vulnerabilities has surfaced the various networks. With the rapidly growing technology, the ease of accessibility through web applications has revolutionized the traditional view of an office or a company completely. Web application carries sensitive data and they are accessible 24 × 7. Web site hacking continue to gain popularity as hackers are exploiting vulnerabilities across all geographies and across various types of web technologies. Hackers are constantly experimenting with a wide range of attacking techniques to compromise websites and hack sensitive data such as credit card number, social security number and other personal information. The three most commonly used attacks, according to Open Web Application Security Project (2012) vulnerability list have been discussed in this paper, namely SQL injection attack (SQLIA), cross-site scripting (XSS) and Cross site request forgery (CSRF) attack. In this paper, we present a security engine to counter SQLIA, XSS attack and CSRF attack.

Analysis and Mitigation of NoSQL Injections

NoSQL data storage systems have become very popular due to their scalability and ease of use. Unfortunately, they lack the security measures and awareness that are required for data protection. Although the new data models and query formats of NoSQL data stores make old attacks such as SQL injections irrelevant, they give attackers new opportunities for injecting their malicious code into the statements passed to the database. Analysis of the techniques for injecting malicious code into NoSQL data stores provides examples of new NoSQL injections as well as Cross-Site Request Forgery attacks, allowing attackers to bypass perimeter defenses such as firewalls. Analysis of the source of these vulnerabilities and present methodologies can mitigate such attacks. Because code analysis alone is insufficient to prevent attacks in today's typical large-scale deployment, certain mitigations should be done throughout the entire software life cycle.

Server Side Protection against Cross Site Request Forgery using CSRF Gateway

The E-Commerce and Social Media has become the new identity for millions of users across the globe. Ease of services for Shopping, Travel, Internet Banking, Social Media, chat and collaboration Apps etc. have become part of one’s life where these identities have name, media content, confidential notes, business projects and credit cards. Convenience and connections brings the ease of connectivity and services so does come the concerns related to unauthorized usage and fraudulent transactions that could be lead to loss of money, time, emotions and even life. Web defacement, fake accounts, account hijacking, account lock and unavailability of services has become a common online news and distress for many. There are different Web Attacks and exploits that have sprung up with time and usage for different type of illegal actions performed everyday online. Cross Site Request Forgery Attack is one of the Web top 10 exploited attacks for the past 5 years (Source OSWAP) which can maliciously exploit online services, where unauthorized actions are performed by the fraudulent user on behalf of a trusted and authenticated account for website. It forces the victim user to perform some unauthorized activity on behalf of attacker request. This research work focuses on a new Hybrid strategy that will enhance the server side protection against CSRF attacks. CSRF Gateway, is the proposed solution which provides the Server Side protection against Cross Site Request Forgery (CSRF) Attack.

Building a Robust Client-Side Protection Against Cross Site Request Forgery

In recent years, the web has been an indispensable part of business all over the world and web browsers have become the backbones of today's systems and applications. Unfortunately, the number of web application attacks has increased a great deal, so the matter of concern is securing web applications. One of the most serious cyber-attacks has been by cross site request forgery (CSRF). CSRF has been recognized among the major threats to web applications and among the top ten worst vulnerabilities for web applications. In a CSRF attack, an attacker takes liberty be authorized to take a sensitive action on a target website on behalf of a user without his knowledge. This paper, providing an overview about CSRF attack, describes the various possible attacks, the developed solutions, and the risks in the current preventive techniques. This paper comes up with a highly perfect protection mechanism against reflected CSRF called RCSR. RCSR is a tool gives computer users with full control on the attack. RCSR tool relies on specifying HTTP request source, whether it comes from different tab or from the same one of a valid user, it observes and intercepts every request that is passed through the user’s browser and extracts session information, post the extracted information to the Server, then the server create a token for user's session. We checked the working of RCSR extension, our evaluation results show that it is working well and it successfully protects web applications against reflected CSRF.

CSRFDtool: Automated Detection and Prevention of a Reflected Cross-Site Request Forgery

The number of Internet users is dramatically increased every year. Most of these users are exposed to the dangers of attackers in one way or another. The reason for this lies in the presence of many weaknesses that are not known for ordinary users. In addition, the lack of user awareness is considered as the main reason for falling into the attackers' snares. Cross Site Request Forgery (CSRF) has placed in the list of the most dangerous threats to security in OWASP Top Ten for 2013. CSRF is an attack that forces the user's browser to send or perform unwanted request or action without user awareness by exploiting a valid session between the browser and the server. When CSRF attack success, it leads to many bad consequences. An attacker may reach private and personal information and modify it. This paper aims to detect and prevent a specific type of CSRF, called reflected CSRF. In a reflected CSRF, a malicious code could be injected by the attackers. This paper explores how CSRF Detection Extension prevents the reflected CSRF by checking browser specific information. Our evaluation shows that the proposed solution is successful in preventing this type of attack.

CSRF 공격기법에 대한 제로보드상의 취약점 방어

Abstract Zeroboard is a public bulletin board that can support PHP and MySQL. It has been used by many people because it is easy to use, but there is no more updates after Zeroboard4. So, there is a problem that its administrator will have nothing to do about it if zeroboard has a vulnerability. In this paper, we will discuss about CSRF(Cross Site request Forgery) which is developed and expanded by XSS(Cross Site Scripting). Also, we will find CSRF attacks and suggest an alternative method using VM-ware. The main features and contributions of the proposed method are as follows. First, make an environment construction using VM-ware and other tools. Second, analyze and prepare vulnerabilities using Proxy server. Performance evaluation will be conducted by applying possible countermeasure. Key Words : Zeroboard, CSRF, VM-ware * 준회원, 홍익대학교 컴퓨터정보통신공학과 ** 종신회원, 홍익대학교 컴퓨터정보통신공학과접수일자 : 2014년 4월 4일, 수정완료 : 2014년 6월 24일게재확정일자 : 2014년 8월 8일Received: 4 April, 2014 / Revised: 24 June, 2014 Accepted: 8 August, 2014

Client Side CSRF Defensive Tool

Cross Site Request Forgery (CSRF) attack is immerged as serious threat to web applications which based on the vulnerabilities present in the normal request response pattern of HTTP protocol. It is difficult to detect and hence it is present in most of the existing web applications. Various defensive mechanisms have been suggested for CSRF but none of them provides complete protection against it. Few of these are client side tools and other needs both client as well as server side implementation. Maximum of these works for Reflected CSRF and very few has taken a note of stored CSRF. So to handle protect web applications securely, strong and client side protection against CSRF is needed. In this paper we have proposed CSRF defensive tool which provide complete CSRF protection. This is client side tool and not disturbs server side functionality. It can be implemented on browser as a plug-in. This tool works for both stored as well as reflected CSRF attack.

CSRF Vulnerabilities and Defensive Techniques

Web applications are now part of day to day life due to their user friendly environment as well as advancement of technology to provide internet facilities, but these web applications brought lot of threats with them and these threats are continuously growing, one of the these threat is Cross Site Request Forgery(CSRF). CSRF attack is immerged as serious threat to web applications which based on the vulnerabilities present in the normal request response pattern of HTTP protocol. It is difficult to detect and hence it is present in most of the existing web applications. CSRF attack occurs when a malicious web site causes a user's web browser to perform an unwanted action on a trusted site. It is listed in OWASP's top ten Web Application attacks list. In this survey paper we will study CSRF attack, CSRF vulnerabilities and its defensive measures. We have compared various defense mechanisms to analyse the best defense mechanism. This study will help us to build strong and robust CSRF protection mechanism.

Systematically breaking and fixing OpenID security: Formal analysis, semi-automated empirical evaluation, and practical countermeasures

OpenID 2.0 is a user-centric Web single sign-on protocol with over one billion OpenID-enabled user accounts, and tens of thousands of supporting websites. While the security of the protocol is clearly critical, so far its security analysis has only been done in a partial and ad-hoc manner. This paper presents the results of a systematic analysis of the protocol using both formal model checking and an empirical evaluation of 132 popular websites that support OpenID. Our formal analysis reveals that the protocol does not guarantee the authenticity and integrity of the authentication request, and it lacks contextual bindings among the protocol messages and the browser. The results of our empirical evaluation suggest that many OpenID-enabled websites are vulnerable to a series of cross-site request forgery attacks (CSRF) that either allow an attacker to stealthily force a victim user to sign into the OpenID supporting website and launch subsequent CSRF attacks (81%), or force a victim to sign in as the attacker in order to spoof the victim's personal information (77%). With additional capabilities (e.g., controlling a wireless access point), the adversary can impersonate the victim on 80% of the evaluated websites, and manipulate the victim's profile attributes by forging the extension parameters on 45% of those sites. Based on the insights from this analysis, we propose and evaluate a simple and scalable mitigation technique for OpenID-enabled websites, and an alternative man-in-the-middle defense mechanism for deployments of OpenID without SSL.

Evolution of cross site request forgery attacks

This paper presents a state of the art of cross-site request forgery (CSRF) attacks and new techniques which can be used by potential intruders to make them more effective. Several attack scenarios on widely used web applications are discussed, and a vulnerability which affect most recent browsers is explained. This vulnerability makes it possible to perform effective CSRF attacks using the XMLHTTPRequest object. In addition, this paper describes a new technique that preserves the malicious code on the target system even after the browser window is closed. Lastly, best solutions to prevent these attacks are discussed to enable everyone (users, browser or Web applications developers, professionals in charge of IT security in an organization or a company) to prevent or manage this threat.