CSRF Bouncing

Architecture and Background

DEF CON 16 - Michael Brooks: CSRF Bouncing In this talk I will be discussing Exploit Chaining in Web Applications and CSRF. I will discuss the surface area problem in security and how to gain access to a l attack surface using CSRF. I will detail the process I used to find and exploit a vulnerability in a real world application.

Vulnerability Analysis

I will discuss how to have fun in a sandbox and defeating CSRF protection. I will also talk about the defenses against these attacks. I will be releasing an 0-day exploit and provide a machine for the audience to break into.

Exploitation and Demonstrations

Michael Brooks is a security researcher engaged in exploit development. Michael is interested in real world attacks as well as new methods of exploitation. He enjoy finding flaws in applications and writing exploit code.

Remediation and Defensive Strategies

CVE's from Michael: CVE-2008-2019,CVE-2008-2020,CVE-2008-2043,CVE-2007-6471,CVE-2007-6459,CVE-2007-6458,CVE-2007-0134,CVE-2007-0132, CVE-2007-0130,CVE-2006-6781,CVE-2006-3208,CVE-2006-3207,CVE-2006-3206,CVE-2006-3205,CVE-2006-3204,CVE-2006-3203. Michael is a computer science student at Northern Arizona University. Michael has successfully worked in penetration testing as well as software quality control. Currently he works for as a security engineer and recently started the website: For copies of the slides and additional materials please see the DEF CON 16 Archive here: