CSRF: El "Nuevo" Target - Juan David Castro

# Overview Juan David Castro presents a comprehensive examination of Cross-Site Request Forgery (CSRF), a web vulnerability that exploits applications' failure to verify that requests are legitimately sent by logged-in users. He positions CSRF as a significant security issue, noting it appears in OWASP's top 10 vulnerabilities and experienced a 10% increase in attacks between 2012–2013.

# Key Topics **CSRF Mechanism**: CSRF works by tricking a legitimate user into sending a forged request to a server while authenticated. The attacker sends a malicious link (via email, chat, or social media) to a victim. When the victim clicks it, the request executes with their privileges, allowing attackers to perform actions such as changing passwords, transferring funds, escalating privileges, or modifying account details.

**Exploitation Methods**: Castro explains two primary approaches: GET-based (URL parameters) and POST-based (browser headers). Exploitation typically requires only a simple image request or HTML file combined with social engineering. He demonstrates how these methods can be delivered through seemingly innocent links.

**Detection Tools**: Castro mentions the "C tester" tool for developers to identify web applications lacking CSRF protection by analyzing requests, extracting parameters, and creating proofs of concept.

# Real-World Examples Castro presents several documented vulnerabilities: - **Twitter**: The CSRF protection mechanism existed but was not properly verified server-side, allowing account takeover. He demonstrates this with a video showing how he gained access to a target account via a malicious link and password reset exploitation. - **WordPress**: A proof of concept using an unprotected WordPress application that allowed remote profile modification without security tokens. - **Unknown Army hacker group**: Reportedly impersonated a magazine editor via CSRF, escalating privileges from regular user to editor/publisher. - **Router/WiFi settings**: Vulnerabilities allowing attackers to change WiFi passwords and static IP settings. - **Instagram**: A vulnerability exposing hidden profile photos through CSRF. - **Django and header-based protections**: Castro explains that some frameworks verify tokens through headers rather than server-side validation, creating bypass opportunities.

# Technical Details Castro demonstrates bypassing CSRF protections by chaining it with XSS (Cross-Site Scripting) vulnerabilities. By injecting JavaScript to extract CSRF tokens from a form, an attacker can obtain valid tokens and bypass token-based defenses. He shows code examples where JavaScript extracts form parameters (including CSRF tokens) and uses them in subsequent requests.

HTML5 features (XHR, CORS, local storage) expand CSRF possibilities. However, Castro notes that storing CSRF tokens in local storage is insecure, as they can be retrieved from victim browsers.

# Defenses and Takeaways Protection mechanisms include: - Server-side verification of CSRF tokens - Referrer header validation - Security libraries (PHP implementations, WordPress plugins, Angular CSRF Express Control) - Form protection mechanisms

Castro emphasizes that defenses can still be bypassed if combined with other vulnerabilities like XSS, and that comprehensive security audits are essential. He recommends WebGoat as a resource for learning CSRF exploitation and defense. The presenter received Twitter recognition for his vulnerability reports, highlighting the value of responsible disclosure through bug bounty programs.