GPEN · Question #449
While performing an assessment on a banking site, you discover the following link: hnps://mybank.com/xfer.aspMer_toMaccount_number]&amount-[dollars] Assuming authenticated banking users can be lured…
The correct answer is C. <scripr>document.\write('hTtp$://mybankxom/xfer.a$p?xfer_to-[attacker.accountl &amount-. A CSRF attack forges an authenticated HTTP request from a victim's browser by embedding a crafted URL on an attacker-controlled page, exploiting the victim's active session cookies.
Question
While performing an assessment on a banking site, you discover the following link:
hnps://mybank.com/xfer.aspMer_toMaccount_number]&amount-[dollars] Assuming authenticated banking users can be lured to your web site, which crafted html tag may be used to launch a XSRF attack?
Options
- A<imgsrc-"java script alert (`document cookie'):">
- B<scripi>alert('hnps:/'mybank.com/xfer.a$p?xfer_io-[attacker_account]&amoutn-
- C<scripr>document.\write('hTtp$://mybankxom/xfer.a$p?xfer_to-[attacker.accountl &amount-
- D<img src-'https/mybank.com/xfer.asp?xfer_to=[artacker_account]&amount= [dollars]">
How the community answered
(39 responses)- A5% (2)
- B10% (4)
- C77% (30)
- D8% (3)
Why each option
A CSRF attack forges an authenticated HTTP request from a victim's browser by embedding a crafted URL on an attacker-controlled page, exploiting the victim's active session cookies.
An img tag invoking a JavaScript alert with document.cookie is a Cross-Site Scripting (XSS) payload that attempts to steal cookies, not a CSRF attack that forges an authenticated transaction.
A script tag using alert() only displays a dialog box to the user - it does not cause the browser to issue an HTTP request to the transfer endpoint and therefore does not perform the forged transaction.
A script tag using document.write() dynamically injects content into the attacker's page that triggers the bank transfer URL with the attacker's account substituted as the recipient; when an authenticated banking user visits the attacker's site, the victim's browser automatically includes valid session cookies with the forged GET request to mybank.com, silently transferring funds. This technique exploits the trust a site places in the user's authenticated browser session.
An img src tag pointing to the transfer URL is a recognized CSRF vector that would silently trigger a GET request, but this choice is not selected as the correct answer per the provided key.
Concept tested: Crafting a CSRF attack using script injection
Source: https://owasp.org/www-community/attacks/csrf
Topics
Community Discussion
No community discussion yet for this question.