Hosting generously provided by
|
|
What is Cross Site Reques Forgery?
|
Cross Site Request Forgery (also known as XSRF) works by exploiting the trust of a users intentions.
Site tasks are usually linked to specific urls (Example: http://site/stocks?buy=100&stock=ebay) allowing a certain action to happen when visited
by the user.
If a user is logged into the site and an attacker tricks their browser into making a request to one of these task urls,
then the task is performed and logged as the logged in user. Typically you'll use to embed an IMG tag
or other HTML/Javascript code to request a specific 'task url' and if the user is logged in it will get executed without
their knowledge. These sorts of attacks are fairly difficult to detect potentially leaving a user debating with the
website/company as to whether or not the stocks bought the day before we initiated by the user after the price
plummeted.
|
|
|
Information contained on this website may not be copied without explicit permission.
Best Viewed with Netscape.
|
|
|
Subscribe to CGISecurity.com
|
|
|
|
|
|
The Web Security Mailing List
|
|
|
|
|
Contact us
|
Post News, get linkage!
|
|
|
|
