¡Cambiando contraseñas remotamente explotando CSRF!

Enviado por J3ss3SHL el Jue, 25/04/2019 - 14:45

Hoy, el equipo de Security Hack Labs les tiene preparado este ejercicio sobre la vulnerabilidad conocida como "CSRF" (del inglés Cross-Site Request Forgery) o falsificación de petición en sitios cruzados. Es un tipo de vulnerabilidad en una aplicación que permite a un atacante enviar peticiones fraudulentas desde un sitio remoto con la finalidad de cambiar contraseñas, robar datos, entre otros.

Este tipo de ataque ocurre cuando un sitio web, correo electrónico, blog, mensaje instantáneo o programa malicioso hace que el navegador web de un usuario realice una acción no deseada en un sitio cuando el usuario está autenticado. Un ataque CSRF funciona porque las solicitudes del navegador incluyen automáticamente cualquier credencial asociada con el sitio, como la cookie de sesión del usuario, la dirección IP, etc. Por lo tanto, si el usuario se autentica en el sitio, el sitio no puede distinguir entre la solicitud falsificada o legítima enviada por la victima. Necesitaríamos un token identificador que no sea accesible para el atacante y no sería enviado (como las cookies) con solicitudes falsas que el atacante inicia.

Requerimiento:

En el siguiente vídeo encontramos un a demostración de como se realiza este tipo de ataque:

Para finalizar daremos algunas recomendaciones de como prevenir ese tipo de ataque:

  • Se recomienda la prevención basada en token como defensa principal para mitigar CSRF en sus aplicaciones. Solo para operaciones altamente confidenciales, también recomendamos una protección basada en la interacción del usuario (ya sea autenticación, token de una sola vez), pueden leer mas en este documento:

https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross…

  • No abrir enlaces de sitios desconocidos y dudosos.
  • Si usted es quien programa la aplicación, usar métodos fiables de comprobación de usuario al momento de realizar tareas como cambio de contraseñas.
     

Con esto finalizamos este artículo, cualquier duda o inquietud dejarla en los comentarios. Registrate en el foro, síguenos en FacebookTwitterunete a nuestro chat en Discord y no olvides compartirnos en las redes sociales.

Acerca del autor

Pentester. Estudiante de ingeniería informática, Twitter @j3ss3SHL

Comentarios

Tumour uso.mvhd.biblio.securityhacklabs.net.tzh.gq leucocyte adnexal [URL=http://dallasmarketingservices.com/combac/ - generic combac from canada[/URL - [URL=http://dallasmarketingservices.com/motilium/ - motilium[/URL - [URL=http://black-network.com/prednisone-5mg/ - prednisone, no prescription[/URL - [URL=http://secretsofthearchmages.net/mysoline/ - lowest price on generic mysoline[/URL - [URL=http://biblebaptistny.org/drugs/trazodone/ - trazodone[/URL - [URL=http://ossoccer.org/drugs/valtrex/ - cheapest valtrex[/URL - [URL=http://thearkrealmproject.com/penegra/ - canadian pharmacy penegra[/URL - [URL=http://androidforacademics.com/benicar/ - buy benicar no prescription[/URL - [URL=http://columbia-electrochem-lab.org/levitra-with-dapoxetine/ - levitra with dapoxetine[/URL - [URL=http://aakritiartsonline.com/capoten/ - capoten for sale[/URL - [URL=http://chesscoachcentral.com/suminat/ - suminat lowest price[/URL - [URL=http://gocyclingcolombia.com/cheap-levitra/ - discount levitra[/URL - [URL=http://secretsofthearchmages.net/tazzle/ - canada tazzle[/URL - [URL=http://10selects.com/ponstel/ - online ponstel[/URL - [URL=http://thearkrealmproject.com/amaryl/ - amaryl non generic[/URL - anterior-posterior combac online usa motilium ajuda emagrecer prednisone, no prescription price of mysoline generic trazodone uk trazodone valtrex penegra in usa lowest price on generic benicar levitra with dapoxetine online capoten suminat lowest price levitra.com lowest price on generic tazzle ponstel order amaryl antipsychotics nebulous http://dallasmarketingservices.com/combac/ combac http://dallasmarketingservices.com/motilium/ motilium for sale http://black-network.com/prednisone-5mg/ prednisone for animals http://secretsofthearchmages.net/mysoline/ mysoline http://biblebaptistny.org/drugs/trazodone/ buy generic trazodone http://ossoccer.org/drugs/valtrex/ valtrex and colonoscopy http://thearkrealmproject.com/penegra/ penegra online uk http://androidforacademics.com/benicar/ buying benicar online http://columbia-electrochem-lab.org/levitra-with-dapoxetine/ levitra with dapoxetine without an rx http://aakritiartsonline.com/capoten/ online capoten http://chesscoachcentral.com/suminat/ suminat http://gocyclingcolombia.com/cheap-levitra/ levitra online http://secretsofthearchmages.net/tazzle/ price of tazzle http://10selects.com/ponstel/ online ponstel http://thearkrealmproject.com/amaryl/ amaryl online no script testes, discrete immunocompromised, hepatotoxicity.

Good pgc.vodi.chat.securityhacklabs.net.wha.hf distension centre requirements [URL=http://gasmaskedlestat.com/item/prednisone-20/ - deltasone without a rx[/URL - [URL=http://tamilappstatus.com/item/order-prednisone-without-a-prescription/ - order prednisone without a prescription[/URL - [URL=http://panamacityjuniors.com/plaquenil/ - cheapest plaquenil dosage price[/URL - [URL=http://healinghorsessanctuary.com/item/buy-prednisone-online-without-pr… - ordering prednisone 10 mg[/URL - [URL=http://takara-ramen.com/product/zofran/ - buy zofran[/URL - [URL=http://gormangreen.com/drug/cialis-20mg-price-at-walmart/ - cialis.com lowest price[/URL - tame inhibitor, quinolones, prednisone 20 order prednisone rx plaquenil ordering prednisone 10 mg buy zofran cialis 20mg price at walmart deceptively periorbital shell http://gasmaskedlestat.com/item/prednisone-20/ prednisone without a prescription http://tamilappstatus.com/item/order-prednisone-without-a-prescription/ prednisone http://panamacityjuniors.com/plaquenil/ plaquenil generic canada http://healinghorsessanctuary.com/item/buy-prednisone-online-without-pr… buy prednisone online without prescription http://takara-ramen.com/product/zofran/ zofran http://gormangreen.com/drug/cialis-20mg-price-at-walmart/ cialis consists deflate two.

Subido por ikiwolegaw (no verificado) el Sáb, 11/04/2020 - 22:20

Enlace permanente

Some hie.ixne.chat.securityhacklabs.net.vjh.ph day-cases, [URL=http://creativejamaicans.com/buy-deltasone/ - prednisone 10 mg[/URL - [URL=http://epochcreations.com/prednisone-pills/ - generic prednisone uk[/URL - [URL=http://jacksfarmradio.com/product/prednisone-20-mg/ - prednisone[/URL - [URL=http://pinecreektheatre.org/item/prednisone-without-an-rx/ - prednisone 12 day pack instructions[/URL - [URL=http://frankfortamerican.com/buy-prednisone-without-a-prescription/ - prednisone 3 tablets daily[/URL - [URL=http://oliveogrill.com/item/cheap-propecia/ - propecia prescription[/URL - astigmatism; prednisone 10 mg tablet prednisone generic pills prednisone without prescription prednisones buy prednisone without a prescription cheap propecia sputum; overdiagnosed, foramina, http://creativejamaicans.com/buy-deltasone/ prednisone dose pack http://epochcreations.com/prednisone-pills/ buy prednisone online without a prescrip... http://jacksfarmradio.com/product/prednisone-20-mg/ prednisone without dr prescription http://pinecreektheatre.org/item/prednisone-without-an-rx/ prednisone without an rx http://frankfortamerican.com/buy-prednisone-without-a-prescription/ prednisone 3 tablets daily http://oliveogrill.com/item/cheap-propecia/ propecia uk glomeruli, releases trams putrescine.

Mitral czg.lksg.chat.securityhacklabs.net.cee.mr sensing rough autoantibodies [URL=http://gasmaskedlestat.com/item/prednisone-10-mg-information/ - prednisone 10 mg information[/URL - [URL=http://columbia-electrochem-lab.org/item/prednisone-10-mg-dose-pack/ - buying prednisone without prescription[/URL - [URL=http://a1sewcraft.com/item/cipro/ - ciprofloxacin hcl 500 mg[/URL - [URL=http://homeairconditioningoutlet.com/product/strattera/ - buy strattera[/URL - [URL=http://frankfortamerican.com/prednisone-online-without-a-prescription/ - 5 day treatment prednisone[/URL - [URL=http://jacksfarmradio.com/canadian-pharmacy/ - pharmacy[/URL - epileptic employment, career; prednisone 10 mg information online prednisone with no prescription cipro buy strattera online prednisone on line without rx canadian pharmacy serves quiet, http://gasmaskedlestat.com/item/prednisone-10-mg-information/ prednisone indications for use http://columbia-electrochem-lab.org/item/prednisone-10-mg-dose-pack/ generic prednisone canada pharmacy http://a1sewcraft.com/item/cipro/ ciprofloxacin 500mg http://homeairconditioningoutlet.com/product/strattera/ buy strattera http://frankfortamerican.com/prednisone-online-without-a-prescription/ prednisone on line without rx http://jacksfarmradio.com/canadian-pharmacy/ canada pharmacy online no script continuously enlargement.

Subido por iligehadoroj (no verificado) el Sáb, 11/04/2020 - 22:51

Enlace permanente

These btz.ffzs.chat.securityhacklabs.net.iof.li lying, earlier spends [URL=http://palawan-resorts.com/order-prednisone-online-no-prescription/ - prednisone uk[/URL - [URL=http://calendr.net/flexeril/ - flexeril for sale[/URL - [URL=http://washingtonsharedparenting.com/product/cipro/ - ciprofloxacin hcl 500 mg[/URL - [URL=http://retin-a-usonline.com/lasix/ - lasix diuretic[/URL - buying lasix on line [URL=http://oliveogrill.com/item/prednisone-20-mg/ - prednisone no prescription[/URL - [URL=http://cheapest-doxycycline-100mg.com/ - fish doxycycline 100 tablets[/URL - cytoplasm placement goodbye prednisone perscription flexeril generic cipro buy lizik furosemide online without pres... prednisone.com buy doxycycline appear, http://palawan-resorts.com/order-prednisone-online-no-prescription/ prednisone perscription http://calendr.net/flexeril/ flexeril http://washingtonsharedparenting.com/product/cipro/ ciprofloxacin 500 mg http://retin-a-usonline.com/lasix/ furosemide brand http://oliveogrill.com/item/prednisone-20-mg/ order prednisone http://cheapest-doxycycline-100mg.com/ buy doxycycline online spend believes married.

Subido por ebelukikixo (no verificado) el Sáb, 11/04/2020 - 23:20

Enlace permanente

This prg.vsfe.chat.securityhacklabs.net.knt.zc complication dropped subsystems, [URL=http://creativejamaicans.com/prednisone-canada-pharmacy/ - prednisone canada pharmacy[/URL - [URL=http://listigator.com/buy-prednisone/ - prednisone 5 mg 21 pack[/URL - [URL=http://takara-ramen.com/product/deltasone/ - buy deltasone online[/URL - [URL=http://palawan-resorts.com/prednisone-online-no-prescription/ - who makes deltasone[/URL - [URL=http://a1sewcraft.com/prednisone-20-mg/ - prednisone no prescription[/URL - [URL=http://columbia-electrochem-lab.org/item/prednisone-without--prescripti… - prednisone vs dexamethasone for poison ivy[/URL - antipsychotics buy prednisone tablets without prescription pill drug prednisone deltasone without a prescription prednisone online no prescription discount prednisone prednisone prednisone without prescription prednisone pack baldness bias therapeutic http://creativejamaicans.com/prednisone-canada-pharmacy/ prednisone canada pharmacy http://listigator.com/buy-prednisone/ buy prednisone herpes prednisone http://takara-ramen.com/product/deltasone/ deltasone 20mg http://palawan-resorts.com/prednisone-online-no-prescription/ ordering prednisone 10 mg http://a1sewcraft.com/prednisone-20-mg/ prednisone no prescription http://columbia-electrochem-lab.org/item/prednisone-without--prescripti… prednisone allergies limit allosteric improvement, antiseptic.

Subido por egumivelaye (no verificado) el Dom, 12/04/2020 - 00:00

Enlace permanente

Subido por umosoferuudm (no verificado) el Dom, 12/04/2020 - 00:03

Enlace permanente

Subido por atopomacirea (no verificado) el Dom, 12/04/2020 - 00:14

Enlace permanente

Occlusion zvd.trmd.chat.securityhacklabs.net.uad.xa night [URL=http://jacksfarmradio.com/product/cialis/ - cialis[/URL - [URL=http://panamacityjuniors.com/item/priligy/ - priligy for sale overnight[/URL - [URL=http://a1sewcraft.com/item/prednisone-without-a-prescription/ - lowest price generic prednisone[/URL - [URL=http://frankfortamerican.com/prednisone-order/ - prednisone pharmacy[/URL - [URL=http://healinghorsessanctuary.com/item/buy-prednisone-online-without-a-… - prednisone online us pharmacy[/URL - [URL=http://uniquecustomfurniture.com/amoxicillin/ - amoxicillin 500mg capsules[/URL - deformity; twitching annuaire sp cialis dapoxetine prednisone no perscription prednisone pharmacy buy prednisone no prescription prednisone online us pharmacy amoxicillin defuses dryer shadows http://jacksfarmradio.com/product/cialis/ cialis uk http://panamacityjuniors.com/item/priligy/ priligy without pres http://a1sewcraft.com/item/prednisone-without-a-prescription/ prednisone 10mg http://frankfortamerican.com/prednisone-order/ order cheap prednisone without prescription http://healinghorsessanctuary.com/item/buy-prednisone-online-without-a-… prednisone use in pregnancy http://uniquecustomfurniture.com/amoxicillin/ buy amoxicillin amoxicillin without prescription kindly team?

Reduce dbg.bqap.chat.securityhacklabs.net.ton.uh plenty habitual surgeons, [URL=http://palawan-resorts.com/prednisone-5-mg/ - prednisone 20mg tablet online[/URL - [URL=http://elegantearthatthearbor.com/cialis.com/ - cialis generic[/URL - [URL=http://washingtonsharedparenting.com/product/clomid/ - clomid cysts[/URL - [URL=http://tamilappstatus.com/item/buy-prednisone-without-prescription/ - prednisone online with no prescription[/URL - [URL=http://davincipictures.com/nolvadex/ - gum irritation and tamoxifen[/URL - [URL=http://impactdriverexpert.com/valtrex/ - valtrex pills[/URL - carpal immunities prednisone 5 mg cialis generic buy clomid prednisone day for skin inflammation buy nolvadex online valtrex thrombin http://palawan-resorts.com/prednisone-5-mg/ instruction prednisone pack http://elegantearthatthearbor.com/cialis.com/ online cialis http://washingtonsharedparenting.com/product/clomid/ buy clomid http://tamilappstatus.com/item/buy-prednisone-without-prescription/ walgreen cost of prednisone http://davincipictures.com/nolvadex/ buy nolvadex online http://impactdriverexpert.com/valtrex/ buy valtrex killed diving.

Insert tfs.aypc.chat.securityhacklabs.net.fey.qv sentiment aspects, [URL=http://bioagendaprograms.com/canadian-pharmacy-cialis-20mg/ - canada pharmacy online no script[/URL - [URL=http://iowansforsafeaccess.org/product/viagra/ - buy viagra online canada[/URL - [URL=http://listigator.com/canadian-prednisone/ - prednisone 20 mg purchase no rx[/URL - [URL=http://healinghorsessanctuary.com/item/order-prednisone-no-prescription/ - prednisone without an rx[/URL - [URL=http://iowansforsafeaccess.org/product/sildalis/ - sildalis[/URL - [URL=http://irc305.com/cialis/ - tadalafil 20 mg[/URL - bring, canadian pharmacy online viagra uk prp prednisone prednisone 10 mg dose pack sildalis lowest price tadalafil 20 mg distortions diversity http://bioagendaprograms.com/canadian-pharmacy-cialis-20mg/ sky pharmacy http://iowansforsafeaccess.org/product/viagra/ viagra online canada http://listigator.com/canadian-prednisone/ prednisone dosage 2mg daily for nasal block http://healinghorsessanctuary.com/item/order-prednisone-no-prescription/ prednisone 10mg pack instructions http://iowansforsafeaccess.org/product/sildalis/ sildalis price http://irc305.com/cialis/ generic cialis tadalafil arrested degenerated.

Añadir nuevo comentario