Hacking Techniques, Cross Site Request Forgery Attacks A Cross Site Request Forgery Attack happens when a user is logged into a session (or account) and a hacker uses this opportunity to send them a forged HTTP request to collect their cookie information. In most cases, the cookie remains valid as long as the user or the attacker stays logged into the account. This is why websites ask you to log out of your account when you’re finished – it will expire the session immediately. In other cases, once the user’s browser session is compromised, the hacker can generate requests to the application that will not be able to differentiate between a valid user and a hacker. A Cross Site Attack Examples Here’s an example: example/app/transferFunds?amount=1500&destinationAccount=4673243243 In this case the hacker creates a request that will transfer money from a user’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control.
Posted on: Wed, 30 Oct 2013 19:47:00 +0000
Trending Topics
Recently Viewed Topics
© 2015