Bypass CSRF token protection

Heya, as  web and websecurity is getting intense day by day , use of CSRF tokens are becoming a part of web security. Some time ago, use of CSRF token was enough for CSRF protection.Although, CSRF token protection can be bypassed using several  techniques. So This post briefly touches the CSRF Token Protection Bypass Methods. It means that next  time a penetration tester see a CSRF token protection, no need to be sad lol,  he knows what to do next and how to find and exploit weaknesses in CSRF token mechanism.

Token Redundancy

This flaw in CSRF token protection mechanism uses the same CSRF token multiple times, which means that , the same token can be used in our attack payload which is used by our legit request before. In ideal situation, every token has an expiry which means that once the token is used it get expired and cannot be used again. Although, in Web Applications, poor sense of security by developers can lead to such flaws. While pentesting tokens investigating token redundancy can come in handy ;).

 Weak Token Encryption / Validation

The CSRF token is a string, it can be an encrypted string of some value which keeps on incrementing and hence changing the token value. let say the CSRF token of a change password form is

    md5(User_email, inc) //inc is numerical value that keeps on incrementing

The User_email is the email of the logged in legitimate user. This is a weak encryption, because after investigation, the attacker can predict the value of the next token.

It is also possible that some value of the token gets changed or incremented and the other half remains same for example. A Token value is

    SASDwakawe3ioxujwSXjiXguaxSGQjnjSjkaEEnkjxOOa12

The next token is

    SASDwakawe3ioxujwSXjiXguaxSGQjnjSjkaEEnkjxOOa13 //incrementing from backwards, then incrementing the letters like "a" and so on.

This token behavior can also be predicted. After investigation the attacker can predict the next Anti_CSRF token and can use in attack payload.

In Such cases where the token is composed of two parts, and one half remains static the other keeps changing but the attacker is not able to predict the dynamic part of the token. Attacker should investigate can the static part of  Anti_CSRF token gets validated without the dynamic part. For example two CSRF tokens

  MXAfiaW3IFUAxh820dOXADjwsiwDSajaSFFao/9cdfb439c7876e703e307864c9167a15

This shows that the Anti_CSRF Token is composed of two strings. The last part is clearly a MD5. If the former part remains static in all requests and the MD5 hash keeps on changing. It is worth the effort to check either the application validates the token as a whole or what happens of we only provide the static part of the token.

Bypass Anti CSRF Token By Using XSS (Cross Site Scripting)

The main  idea is to get Anti_CSRF token Via XSS. The website should have an XSS Vulnerability. This Article describes how to use XSS to bypass Anti_CSRF token. Credits to the Original Author Anti CSRF Token Protection Bypass Using XSS.

 Token Validation Fail

One last try attacker can make is to test either the token really getting validated? .Can the attacker able to make the request without the token? This might seem lame lol but,  hey if facebook can make such a blunder , anyone can.

All that i know and read about CSRF Token Protection Bypass Methods If you have any other technique, feel free to share.