BugBounty & Hacking Resources – Telegram
BugBounty & Hacking Resources
1.18K subscribers
22 photos
2 videos
5 files
363 links
Download Telegram
During a recent CTF, one participant found a particularly interesting solution to my challenge. The goal was to send multiple CSRF requests with SameSite=Lax from 1 visit.
Normally, a form sends you to the page you are posting to and you cannot send any more CSRF requests.

My intended solution was to use <link rel="prerender" href="..."> to send an authenticated GET request to the CSRF-able endpoint, repeatable without leaving the attacker's page. Prerender represents the full navigation as closely as possible, sending SameSite=Lax cookies.

The unintended technique was something I hadn't seen before. Regular CSRFs often use <form>'s for top-level navigations, but it seems like we cannot control the browser anymore after submitting the form.
But, by cancelling the navigation, it is possible to regain control.


After the request is sent, while waiting for a response from the target, call window.stop() or submit another form to cancel the previous form. Timing can be measured and is surprisingly consistent. Check out the PoC's here:

https://gist.github.com/JorianWoltjer/b9163fe616319db8fe570b4ef9c02291



reference:
https://x.com/J0R1AN/status/1842139861295169836

#csrf #twitter
1
Attacking Secondary Contexts in Web Applications.pdf
2.7 MB
Attacking Secondary Contexts in Web Applications

خیلی عالیههه🔥
👌5👍2