How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against It « Null Byte :: WonderHowTo

Cross-Site Request Forgery (CSRF, pronounce "sea-surf") is a common web exploit. However, for unknown reasons it's not used very often. It plays on a given website's trust in a web browserby executing another website's form action, for example, sending money to another person. It's usually placed in abnormal places like HTML image tags.A website will automatically load the form action from the other site if the users cookies are still active, because it's placed in a tag that loads its content when the page is loaded. This is a very undesired outcome!In thisNull Byte, we're going to see exactly how these attacks work and how we can prevent them in code, as well as on the user-end to stop them from being used on you.Step1Set the StageFor this attack to work you need a website that allows HTML. To find this out, try to craft an HTML link on a post or private message somewhere with the following code.<a href="www.google.com" rel="nofollow" target="_blank" >google</a>If you get a clickable link likethis, then you've done it correctly and the site does allow HTML. However, for this to work a site must not check forHTTP refererheaders.The user being targeted for this form of CSRFmustbe logged into the site we are forging a request from.Step2ExecutionAn attacker needs to make sure the user is logged into the target site. Next, a form action needs to be found that initiates a certain action, one that can be manipulated. Search a page source or test submit forms until you find something like this:http://www.somebank.com/moneysend?from=alex&amount=100&for=nullbyteYou can manipulate it to send more money, like so:http://www.somebank.com/moneysend?from=alex&amount=999999&for=nullbyteTo deploy this attack, we just toss this forged link into an image tag.<img src="http://www.somebank.com/moneysend?from=alex&amount=9999999&for=nullbyte">This attack vector will load whenever the attack target views the page with the spoofed image tag on it. So just post the code to any old site that allows HTML and it will work.But what if they have filter protection? Well, you can use anonymous redirect services or find anXSSexploit to open a new page with JavaScript, which will bypass any redirect filters. This is a very dangerous attack.Prevention MeasuresUseNoScript. It will block XSS and other cross-site attacks.Disable automatic image loading in your browser.Only use sites that you trust. However, this only increases your chances of being safe.YouTubehas CSRF vulnerabilities on literally every action a user can perform on the site.Come say hello to the Null Byte crew! We're starting to get a lot of new members in IRC, you shouldjoin us!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePhoto viaDr. JaysRelatedNews:8 Tips for Creating Strong, Unbreakable PasswordsNews:'Hackers-for-Hire' Attempted to Steal Baidu's Self-Driving Car SecretsHow To:Fix Your Hacked and Malware-Infested Website with GoogleHow To:This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent ItNews:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)News:Apple Says iPhone & iCloud Are Safe After Claimed Breach by 'Turkish Crime Family'How To:This Course Bundle Will Teach You How to Start & Grow a BusinessNews:The Biometric Authentication ConundrumApple Pay Cash 101:What You Need to Get StartedHow To:Patch the SSL Bug Without Updating Your Jailbroken iPad or iPhone to iOS 7.0.6How To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Disable the 'Unlock iPhone to Use Accessories' Notification in iOS 11.4.1 & HigherHow To:Prevent hackers from attacking you on RunescapeHow To:Harness the Power of Google Analytics with This $20 TrainingApple Pay Cash 101:How to Accept or Reject Money from Friends & FamilyHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsHow To:Twitter's Massive Security Flaw Makes Your Password Easy to HackNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreNews:Social Hacking and Protecting Yourself from Prying EyesNews:Update 6/17News:A Cool Site I Found, Write Reviews and Get paid!News:FarmVille Free Animal with Facebook Credits Farm Cash PurchaseGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsNews:Save Big without SkimpingHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:Infinity art Photography Expo - Deadline January 15, 2011News:Indie and Mainstream Online Games Shut Down by LulzSecNews:9 facial masks you can make with ingredients from the kitchenNews:Mystery Game - Black Stallion!How To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:Mine Bitcoin and Make MoneyHow To:8 Weird Ways to Cool Down for SummerNews:Holiday Buildings, Train, Gypsy Horse Released and Unwither Ring!News:Blue Cow and Blue Tree have hit the market in Farmville!Smartphone Challenge:Summer Break CashNews:Win Cash!News:Johnny Cash Fans...Learn "Folsom Prison Blues"Forbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsNews:Beezag!How To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)