I decided to skip
some of the sections about cookies and directly go to the CSRF attacks simply
because I have no previous experience with these attacks and would like to know
more about them. OWASP Defines these attacks as ones "which forces an end
user to execute unwanted action on a web application in which he/she is
currently authenticated". So basically, we trick the admin into executing
harmful code. The concern with this exploit is that often times the admin does
not even know he or she is being tricked into executing code. In fact, even going to a simple and
relatively safe website can cause the code to execute. How does this work?
Let's a you get an
e-mail telling you to visit a website. The website has the following code:
<img src=”https://domain.com/picture.gif” width=”0” height=”0”>
Seems harmless right? Well, domain.com/picture.gif can easily be redirected to http://baddomain.com/badCode.
How do web prevent
this from happening?
OASP Recommends the
following actions.
- Logoff as soon as your done administering.
- Don't allow your browser to save usernames & passwords
- Do not use the same browser to access sensitive information as you use to surf freely on the internet.
