the-web-application-hackers-handbook

512 Chapter 13 n Attacking Users: Other Techniques
provided by the attacker. The attacker’s interface contains content to entice the
user and induce him to perform actions such as clicking the mouse in a particular
region of the page. When the user performs these actions, although it
appears that he is clicking the buttons and other UI elements that are visible in
the attacker’s interface, he is unwittingly interacting with the interface of the
application that is being targeted.
For example, suppose a banking function to make a payment transfer involves
two steps. In the first step, the user submits the details of the transfer. The response
to this request displays these details, and also a button to confirm the action
and make the payment. Furthermore, in an attempt to prevent CSRF attacks,
the form in the response includes a hidden field containing an unpredictable
token. This token is submitted when the user clicks the confirm button, and the
application verifies its value before transferring the funds.
In the UI redress attack, the attacker’s page submits the first request in this
process using conventional CSRF. This is done in an iframe within the attacker’s
page. As it does normally, the application responds with the details of the user
to be added and a button to confirm the action. This response is “displayed”
within the attacker’s iframe, which is overlaid with the attacker’s interface
designed to induce the victim to click the region containing the confirm button.
When the user clicks in this region, he is unwittingly clicking the confirm
button in the target application, so the new user gets created. This basic attack
is illustrated in Figure 13-1.
Figure 13-1: A basic UI redress attack
The reason this attack succeeds, where a pure CSRF attack would fail, is
that the anti-CSRF token used by the application is processed in the normal
way. Although the attacker’s page cannot read the value of this token due to
the same-origin policy, the form in the attacker’s iframe includes the token