‫So there are several types of CSR, FNB Web.
‫I want to do with you one more as well.
‫We can first have a quick look at all the types if you want, so let's log in to be Web and go to see
‫SRF one.
‫And this is a password change and we've exploited the low level.
‫The source of the form and we mimic the request triggered by this form.
‫OK, no change here to two, so here's a second example, view the page source.
‫As you can see, there are no extra fields to secure the form.
‫So now I'm going to intercept the request of this form.
‫And remember, to enable foxy proxy.
‫And burp together request.
‫Data transmits in the early.
‫And it is not so different from the example that we did with a password change form.
‫We just need to change the form field names.
‫And let it go.
‫B Webb also has one more CSIR, for example, so go to the CSR F3 page.
‫Now, this page changes the secret value of the session user.
‫To view the source.
‫OK, now see how this form has an additional hidden field.
‫But it really doesn't bring you any added security.
‫So the only thing you need to know is the longer the name of the user.
‫And when you refresh the page, nothing changes as well.
‫So I'm going to send a request to you it.
‫OK, the request is here in berp.
‫You can easily add these fields to your fake form and request.
‫So now you need to just enumerate users, then prepare fake forms.
‫And that's all.
‫Now go back to square one and change the level of medium.
‫So this is the form that once the user to fill the current password as well.
‫Sure, it's a good measure.
‫And go to see Assaraf to.
‫Nothing changes in a display.
‫But view the source.
‫So this time a token field is added to the form.
‫Now refresh the page.
‫By the token, value is the same.
‫So this is not a good implementation as well.
‫So when we fill the form and send the request will be, as you can see, in berp.
‫So this time you need to enumerate tokens or force users to use your tokens like we did in session fixation.
‫So let it go and go to see Assaraf three.
‫And view the source.
‫This warm also has a token feel.
‫And when you refresh the page.
‫The token changes.
‫OK, so fill in the input field.
‫And this will be the request.
‫So now we are going to exploit this one opened up your terminal.
‫Views, the SRF underscore three.
‫So if the level is low, it just changes the value.
‫But if the level is medium or high at first check, citoyen.
‫So then just update the secret.
‫And below, you can see the code that produced the token on each request.
‫So open up your browser again.
‫OK, so let me summarize a problem.
‫We have a form that has a hidden token field.
‫And this field changes her request.
‫Even if we create a fake form, we cannot get this value right, because the fake form will be triggered
‫in another tab.
‫So fake forms cannot reach what we're looking for in the actual form.
‫We can add a token field to our fake request, but we cannot add a true value.
‫So that means we're basically stuck here.
‫Now, obviously, I have a solution.
‫So to exploit this vulnerability, we'll just going to need another vulnerability.
‫Cross site scripting.
‫So go to X.
‫S.
‫S underscored store page, and we're going to look at this vulnerability a little later in greater detail,
‫but this page stores your entries and shows him just like that.
‫And, of course, it's vulnerable to access, so that means we can execute a JavaScript code on the
‫page from another source.
‫For example, if you add this code, you'll get an alert.
‫And what I want is to execute JavaScript code on my server in this page.
‫So I will serve this code and kaui.
‫It is an example, HDP request code.
‫Then after injecting this code into the page, it'll request a six hour F3 page.
‫Pass the token and then send a change request with a value that I provide.
‫And you can get it from here.
‫So now I'm going to copy it to my Web root directory.
‫Apache's not running so stardate.
‫Now it's running.
‫And now on the access page, I'm just going to add this line of code to inject my script into the page.
‫Copy and paste it.
‫Now, before submitting open web developer.
‫HDMI and JavaScript from here.
‫OK, now submit it.
‫And the alert comes from the previous code.
‫Quick, OK.
‫And below, you will see the request sent by this page.
‫Lo and behold, it requests my JavaScript code from my server.
‫After including that code in the page, my script request, CSR, a three page.
‫And then sends the change request containing a valid token.
‫OK, so now let's look to see if it changes it or not, you know, being Crome.
‫And as you can see, this is the old secret value.
‫So now refresh the page.
‫Browse the user's table again.
‫And looky here, the value has changed.
‫OK, so now view the page source.
‫And the script tags are present in the page just like that.
‫So we change the password without the user's knowledge.
‫What do you think about that?