the-web-application-hackers-handbook

502 Chapter 13 n Attacking Users: Other Techniques
Request Forgery
This category of attack (also known as session riding) is closely related to session
hijacking attacks, in which an attacker captures a user’s session token and
therefore can use the application “as” that user. With request forgery, however,
the attacker need never actually know the victim’s session token. Rather, the
attacker exploits the normal behavior of web browsers to hijack a user’s token,
causing it to be used to make requests that the user does not intend to make.
Request forgery vulnerabilities come in two flavors: on-site and cross-site.
On-Site Request Forgery
On-site request forgery (OSRF) is a familiar attack payload for exploiting stored
XSS vulnerabilities. In the MySpace worm, described in the preceding chapter,
a user named Samy placed a script in his profile that caused any user viewing
the profile to perform various unwitting actions. What is often overlooked is
that stored OSRF vulnerabilities can exist even in situations where XSS is not
possible.
Consider a message board application that lets users submit items that are
viewed by other users. Messages are submitted using a request like the following:
POST /submit.php
Host: wahh-app.com
Content-Length: 34
type=question&name=daf&message=foo
This request results in the following being added to the messages page:
daf
foo
In this situation, you would, of course, test for XSS flaws. However, suppose
that the application is properly HTML-encoding any “< and > characters it inserts
into the page. When you are satisfied that this defense cannot be bypassed in
any way, you might move on to the next test.
But look again. You control part of the target of the tag. Although you
cannot break out of the quoted string, you can modify the URL to cause any user
who views your message to make an arbitrary on-site GET request. For example,
submitting the following value in the type parameter causes anyone viewing
your message to make a request that attempts to add a new administrative user:
../admin/newUser.php?username=daf2&password=0wned&role=admin#