Pages

Subscribe:

Thursday, 27 August 2020

CSRF Referer Header Strip

Intro

Most of the web applications I see are kinda binary when it comes to CSRF protection; either they have one implemented using CSRF tokens (and more-or-less covering the different functions of the web application) or there is no protection at all. Usually, it is the latter case. However, from time to time I see application checking the Referer HTTP header.

A couple months ago I had to deal with an application that was checking the Referer as a CSRF prevention mechanism, but when this header was stripped from the request, the CSRF PoC worked. BTW it is common practice to accept empty Referer, mainly to avoid breaking functionality.

The OWASP Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet tells us that this defense approach is a baaad omen, but finding a universal and simple solution on the Internetz to strip the Referer header took somewhat more time than I expected, so I decided that the stuff that I found might be useful for others too.

Solutions for Referer header strip

Most of the techniques I have found were way too complicated for my taste. For example, when I start reading a blog post from Egor Homakov to find a solution to a problem, I know that I am going to:
  1. learn something very cool;
  2. have a serious headache from all the new info at the end.
This blog post from him is a bit lighter and covers some useful theoretical background, so make sure you read that first before you continue reading this post. He shows a few nice tricks to strip the Referer, but I was wondering; maybe there is an easier way?

Rich Lundeen (aka WebstersProdigy) made an excellent blog post on stripping the Referer header (again, make sure you read that one first before you continue). The HTTPS to HTTP trick is probably the most well-known one, general and easy enough, but it quickly fails the moment you have an application that only runs over HTTPS (this was my case).

The data method is not browser independent but the about:blank trick works well for some simple requests. Unfortunately, in my case the request I had to attack with CSRF was too complex and I wanted to use XMLHttpRequest. He mentions that in theory, there is anonymous flag for CORS, but he could not get it work. I also tried it, but... it did not work for me either.

Krzysztof Kotowicz also wrote a blog post on Referer strip, coming to similar conclusions as Rich Lundeen, mostly using the data method.

Finally, I bumped into Johannes Ullrich's ISC diary on Referer header and that led to me W3C's Referrer Policy. So just to make a dumb little PoC and show that relying on Referer is a not a good idea, you can simply use the "referrer" meta tag (yes, that is two "r"-s there).

The PoC would look something like this:
<html>
<meta name="referrer" content="never">
<body>
<form action="https://vistimsite.com/function" method="POST">
<input type="hidden" name="param1" value="1" />
<input type="hidden" name="param2" value="2" />
...
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

Conclusion

As you can see, there is quite a lot of ways to strip the Referer HTTP header from the request, so it really should not be considered a good defense against CSRF. My preferred way to make is PoC is with the meta tag, but hey, if you got any better solution for this, use the comment field down there and let me know! :)

Related articles


  1. Hacker Tools Apk
  2. Hacking Tools For Pc
  3. Hack Tools Mac
  4. What Is Hacking Tools
  5. Hack App
  6. Best Hacking Tools 2019
  7. Pentest Tools
  8. New Hacker Tools
  9. Pentest Tools Website
  10. Hacking Tools Software
  11. Hacking App
  12. Hacking Tools For Games
  13. Hack Tool Apk
  14. Nsa Hacker Tools
  15. Best Pentesting Tools 2018
  16. Hacking Tools Online
  17. Hack Tools For Ubuntu
  18. Hacker Tools Linux
  19. Pentest Tools List
  20. Hacking Tools Name
  21. Hack Tools For Ubuntu
  22. Hacking Tools For Games
  23. Hack Tools For Games
  24. Hak5 Tools
  25. Hacker Tools List
  26. World No 1 Hacker Software
  27. Hacking Tools For Windows Free Download
  28. Hacking Tools Github
  29. How To Install Pentest Tools In Ubuntu
  30. Hacker Tools Apk Download
  31. Tools For Hacker
  32. Hacker Tools Linux
  33. Hacker Tools Online
  34. Tools For Hacker
  35. Hacking Tools
  36. Hack App
  37. Hack Tools
  38. Hacking Tools For Pc
  39. Bluetooth Hacking Tools Kali
  40. Hacking Tools Mac
  41. Pentest Tools Website Vulnerability
  42. Bluetooth Hacking Tools Kali
  43. Ethical Hacker Tools
  44. Hacking Tools Windows 10
  45. Hacking Tools Download
  46. Hacker Tools Free Download
  47. Pentest Tools Nmap
  48. Pentest Tools Alternative
  49. Pentest Tools Framework
  50. Hacks And Tools
  51. Hacker Techniques Tools And Incident Handling
  52. Hacker Tools For Ios
  53. Hack Tools Pc
  54. Hacking Tools Windows 10
  55. Hack Tools
  56. Pentest Tools Online
  57. Pentest Tools Open Source
  58. How To Install Pentest Tools In Ubuntu
  59. Pentest Tools Bluekeep
  60. Hacking Tools Hardware
  61. Pentest Box Tools Download
  62. Pentest Tools For Mac
  63. Hacking Tools Usb
  64. World No 1 Hacker Software
  65. Pentest Tools Review
  66. Nsa Hacker Tools
  67. Android Hack Tools Github
  68. Pentest Tools Linux
  69. What Is Hacking Tools
  70. Pentest Box Tools Download
  71. Hacker Tools 2020
  72. Hack Tools Github
  73. Hack Tools For Mac
  74. Tools For Hacker
  75. Hacking Tools 2020
  76. Easy Hack Tools
  77. Pentest Tools Open Source
  78. Hack Rom Tools
  79. Pentest Automation Tools
  80. Hacker Tools For Mac
  81. Hacker Tools 2019
  82. Black Hat Hacker Tools
  83. Hacker Tools Windows
  84. Hacker Tools Software
  85. Hack Tool Apk
  86. Tools 4 Hack
  87. Hacker Hardware Tools
  88. Hacker Tools Hardware
  89. Pentest Tools Windows
  90. Top Pentest Tools
  91. Hack Tools 2019
  92. How To Make Hacking Tools
  93. Underground Hacker Sites
  94. Hack Tools For Pc
  95. Hacking Tools For Mac
  96. Hack Tools Mac
  97. Pentest Recon Tools
  98. Pentest Tools
  99. Hackrf Tools
  100. Pentest Tools For Android
  101. Android Hack Tools Github
  102. Termux Hacking Tools 2019
  103. Hacker Tool Kit
  104. Nsa Hack Tools
  105. Hacking Tools Name
  106. Pentest Tools Android
  107. World No 1 Hacker Software
  108. Beginner Hacker Tools
  109. Hacker Tools Hardware
  110. Hack Tools
  111. Hacking Tools Windows 10
  112. Hack Tools For Games
  113. Pentest Tools Github
  114. Underground Hacker Sites
  115. Hack Tool Apk
  116. Hack Tools Download
  117. Pentest Tools Free
  118. Hack Tool Apk No Root
  119. Kik Hack Tools
  120. Black Hat Hacker Tools
  121. Hacker Tools Windows
  122. Hackrf Tools
  123. Pentest Box Tools Download
  124. Hacker Security Tools
  125. Pentest Tools Apk
  126. Pentest Tools Nmap
  127. Hacker Tools Free Download
  128. Usb Pentest Tools
  129. Hacking Tools Software
  130. Hack Tools For Ubuntu
  131. Hacking Apps
  132. Hack Tools
  133. Hacker Tools For Ios
  134. Hack App
  135. Hackrf Tools
  136. Hacker Tools Linux
  137. Pentest Tools Windows
  138. Hack Website Online Tool
  139. Hack Website Online Tool
  140. Hacking Tools Mac
  141. Hackers Toolbox
  142. Hack Tools Mac
  143. Usb Pentest Tools
  144. Hacking Tools Github
  145. Pentest Tools For Mac
  146. Hacking Tools Kit
  147. Pentest Tools For Android
  148. Hack Tools Github

No comments:

Post a Comment