Walks

网络安全爱好者

浅谈CSRF和CRLF

     最近为了学习XSS看了一个JS的教程,感觉自己对于XSS的理解更深刻了一些,所以想要写一写关于XSS的知识汇总。

     那说道XSS的学习,CSRF怎能不谈,下面就来谈一谈CSRF。

     那什么是CSRF?

百度百科上面的解释为:CSRF(Cross-site request forgery跨站请求伪造,也被称为”One Click Attack”或者Session Riding,通常缩写为CSRF或者XSRF,是一种对网站的恶意利用。尽管听起来

像跨站脚本(XSS),但它与XSS非常不同,并且攻击方式几乎相左。XSS利用站点内的信任用户,而CSRF则通过伪装来自受信任用户的请求来利用受信任的网站。与XSS攻击相比,CSRF攻击往

往不大流行(因此对其进行防范的资源也相当稀少)和难以防范,所以被认为比XSS更具危险性。

下面谈谈我对CSRF的个人理解:我认为,CSRF就是一种攻击手法,通过伪造一些表单或者请求,来让登陆过的用户进行点击,当用户点击过后,就达到了攻击者的目的。利用情况通常在一些

个人信息修改,修改密码的部分,就是登陆过的用户可以进行的操作。

下面是加深理解的一张图。

《浅谈CSRF和CRLF》

有些人可能会问了,这是怎么回事呢?

下面WALKS将会带你进入CSRF课堂。

     CSRF原理课堂~

首先,在我们访问一个网站的时候,其实我们是发送一个HTTP/HTTPS请求,然后服务器返回一个返回包,经过浏览器解析,我们才可以看到那么生动的网页。

而当我们登陆一个网站并且修改自己的个人信息的时候,其实我们也是发送一个HTTP/HTTPS的请求包。就像下面这样。


     POST /api/modify HTTP/1.1
     User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
     Accept: */*
     Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
     Accept-Encoding: gzip, deflate, br
     Content-Type: application/json
     Content-Length: 69
     Cookie: id=123
     Connection: close

     {“name”:”xiaoli”,”email”:”12345678@qq.com”}


而我们点击别人发来的网页或者表单的时候,其实也是发送这个请求。

那么发送这个请求需要什么?从上面可知,除了cookie之外,其他的数据攻击者都是可以构造的,所以,要想达到CSRF的目的,只要获得被攻击者的cookie即可。

当我们点击有着CSRF攻击的页面,其实就是用我们的cookie发送这个修改个人信息的请求。这就是CSRF,你听懂了么。

      攻击与防御是一对深爱着的情人,说了攻击方法,怎能少的了防御手法。

下面来谈一谈

     CSRF的防御手法

    1:验证码(但是考虑到什么操作都要验证码,用户体验太差)

     2:Refer头,就是验证前一个网页是从哪里来的,当前一个网页符合条件,才能进行下面的操作。

     3:Token,必须随机,要让攻击者无法猜到即可。(一些框架里自带Token)

 

     这里要补充一个更加强大的攻击手法。XSRF

     XSRF就是XSS+CSRF。被称作XSRF

     通过XSS获取Token来达到CSRF的操作。

 

对于 CSRF的谈论就是这些了。说了CSRF,同样,我们来说说CRLF

同样的开头

      什么是CRLF

      百度百科的解释:CRLF — Carriage-Return Line-Feed 回车换行

      什么?简单的回车换行,你在逗我?

      当然不是在逗你了,的确,这也是一个漏洞来着。主要是利用了HTTP协议来达到攻击的目的。

      上面我们也说过,当我们访问一个网页的时候,其实是一个发送HTTP请求的过程。如果我们加入一些代码那会如何,说干就干。%0a%0d就是\r\n的url编码

       https://twitter.com/login?redirect_after_login=123%0a%0d%0a%0d%3Cimg%20src=1%3E

      上面的请求会在返回包中加入一个<img src=1>,如果换一个XSS代码是不是就是一个XSS漏洞了呢?

       好了,CSRF就是这样。

点赞
  1. Thank you so much for giving everyone an exceptionally breathtaking possiblity to read from this web site. It is often very kind and as well , jam-packed with a great time for me personally and my office peers to search your blog at least thrice in one week to read through the new guides you will have. And definitely, I'm at all times contented with the gorgeous information served by you. Some two facts in this article are truly the best we have all ever had.

  2. birkin bag说道:

    I happen to be commenting to make you be aware of of the helpful encounter our girl undergone browsing your web site. She came to find many details, which include how it is like to have a great teaching character to have many people easily know various extremely tough things. You actually surpassed visitors' expectations. Thanks for giving the insightful, trustworthy, edifying not to mention easy tips on the topic to Janet.

  3. yeezy boost 350说道:

    I not to mention my pals appeared to be studying the nice hints on the website and quickly I had a terrible feeling I never thanked the site owner for those tips. All of the people were definitely for this reason glad to study all of them and now have honestly been making the most of those things. Appreciation for really being so helpful and for considering this sort of remarkable issues most people are really desperate to be aware of. My sincere apologies for not expressing appreciation to sooner.

  4. yeezy 700说道:

    My wife and i have been really glad that Louis could carry out his preliminary research through your ideas he received through the web page. It's not at all simplistic to just continually be releasing tactics other people may have been making money from. We really do understand we have the writer to give thanks to for that. The most important illustrations you've made, the straightforward blog menu, the friendships you make it possible to create - it's got all powerful, and it's really aiding our son and us know that that content is amusing, which is exceedingly fundamental. Thanks for everything!

  5. jordan 4说道:

    I and also my guys have already been viewing the best solutions located on your site and so immediately got an awful suspicion I had not expressed respect to the site owner for those techniques. My men happened to be as a result glad to read through them and now have actually been tapping into them. Appreciate your genuinely quite thoughtful and for deciding on this kind of notable tips most people are really desirous to discover. My sincere regret for not saying thanks to earlier.

  6. I must voice my love for your kind-heartedness in support of men who have the need for help on this one matter. Your special dedication to getting the message all over was rather powerful and have without exception enabled workers like me to achieve their aims. Your personal helpful tutorial can mean this much to me and even further to my fellow workers. Thanks a lot; from all of us.

  7. jordan shoes说道:

    I want to express some appreciation to this writer just for bailing me out of this condition. Right after looking out throughout the internet and meeting proposals which were not beneficial, I thought my entire life was done. Being alive minus the approaches to the difficulties you've fixed as a result of your main article content is a serious case, and ones that could have in a wrong way affected my entire career if I hadn't discovered your web page. That know-how and kindness in maneuvering all the pieces was very useful. I don't know what I would have done if I had not encountered such a solution like this. I am able to at this time look forward to my future. Thank you so much for your professional and result oriented guide. I won't be reluctant to propose your web blog to anyone who should get direction on this problem.

  8. I and also my friends appeared to be analyzing the great hints found on the website while instantly I got a terrible feeling I had not thanked the web site owner for them. Those women were as a result excited to study them and have now really been making the most of these things. Appreciation for being indeed accommodating and also for picking this form of terrific themes most people are really eager to be aware of. Our own sincere apologies for not saying thanks to sooner.

  9. cheap jordans说道:

    I wanted to construct a simple comment so as to appreciate you for some of the unique tips and tricks you are giving out on this site. My long internet look up has at the end of the day been recognized with incredibly good know-how to go over with my two friends. I 'd assume that most of us readers actually are very much endowed to live in a fine community with so many awesome professionals with valuable pointers. I feel really blessed to have encountered your entire site and look forward to some more enjoyable moments reading here. Thanks once more for a lot of things.

  10. My wife and i were so joyful when Emmanuel managed to finish off his investigation because of the precious recommendations he obtained using your site. It's not at all simplistic to just choose to be giving away tips and tricks people might have been trying to sell. And we also do know we have got the blog owner to give thanks to for that. Those explanations you made, the easy site menu, the friendships your site aid to instill - it's many exceptional, and it's really helping our son and our family know that this issue is pleasurable, and that's incredibly fundamental. Thanks for the whole thing!

  11. asics shoes说道:

    I in addition to my pals came digesting the good tips and tricks from the website while all of a sudden developed a horrible feeling I had not thanked you for those techniques. All the young men ended up warmed to read all of them and now have sincerely been making the most of those things. I appreciate you for actually being very accommodating and for utilizing variety of terrific topics millions of individuals are really desperate to know about. Our sincere apologies for not saying thanks to you earlier.

  12. nfl jerseys说道:

    My spouse and i got now satisfied that Michael managed to do his investigation through your precious recommendations he acquired in your blog. It is now and again perplexing to just be giving out guidance which some other people might have been trying to sell. And we also take into account we have got the writer to be grateful to for that. The specific explanations you've made, the easy web site menu, the relationships you will make it possible to create - it's got all great, and it is helping our son and the family consider that that topic is awesome, and that's very essential. Thanks for all!

  13. yeezy shoes说道:

    I wish to show my thanks to this writer for bailing me out of such a difficulty. Right after looking through the internet and getting recommendations which were not beneficial, I believed my entire life was done. Existing devoid of the approaches to the problems you've resolved by means of this short post is a serious case, as well as ones that might have negatively damaged my entire career if I had not encountered the blog. Your personal knowledge and kindness in controlling every aspect was useful. I am not sure what I would've done if I had not encountered such a step like this. I am able to now look ahead to my future. Thanks so much for your high quality and amazing guide. I will not think twice to propose your web site to anyone who should get care on this area.

  14. yeezy boost说道:

    I simply wished to say thanks all over again. I'm not certain the things I could possibly have sorted out in the absence of these opinions discussed by you directly on such a question. It seemed to be a very depressing matter for me personally, however , observing your specialized technique you managed it took me to weep for joy. Now i'm happy for this assistance and wish you comprehend what a great job that you are carrying out teaching men and women via your web blog. I am certain you've never encountered any of us.

  15. I simply wished to appreciate you once more. I am not sure the things that I would've tried without these ways shared by you regarding such situation. It was actually the challenging dilemma in my opinion, nevertheless finding out the very skilled way you dealt with the issue made me to weep for contentment. I will be happy for this service and in addition hope that you recognize what an amazing job that you are putting in teaching some other people with the aid of a blog. I'm certain you haven't met any of us.

  16. golden goose说道:

    A lot of thanks for your own hard work on this site. My mom take interest in working on investigations and it's really simple to grasp why. We all know all concerning the dynamic manner you provide practical tactics via this blog and as well as invigorate response from others on that subject matter so my simple princess is certainly being taught a lot of things. Have fun with the rest of the new year. Your performing a terrific job.

  17. nike polo shirts说道:

    I simply wanted to develop a message in order to appreciate you for these lovely information you are showing at this website. My considerable internet search has now been paid with reputable insight to share with my family and friends. I would express that we readers are really endowed to dwell in a remarkable website with many outstanding people with good guidelines. I feel pretty fortunate to have seen your weblog and look forward to really more fabulous times reading here. Thank you once more for everything.

  18. Thank you so much for giving everyone an extremely nice opportunity to check tips from this blog. It really is so enjoyable plus jam-packed with a great time for me and my office colleagues to visit your blog on the least 3 times per week to read the fresh issues you have got. And indeed, we're usually satisfied considering the outstanding tips you give. Certain 2 tips in this post are ultimately the best we've had.

  19. longchamp outlet说道:

    Thank you for all your effort on this website. Betty really likes doing research and it's really obvious why. My partner and i notice all of the powerful ways you create rewarding suggestions by means of your website and as well attract contribution from other people on this idea while my daughter is in fact becoming educated a whole lot. Take pleasure in the remaining portion of the year. You are always doing a fantastic job.

  20. Needed to post you this tiny note in order to thank you so much again for your stunning concepts you have contributed above. This is really extremely generous of you to supply publicly what exactly numerous people would have offered for an e book to help with making some dough for their own end, specifically considering the fact that you could have done it if you considered necessary. Those inspiring ideas in addition worked like the easy way to fully grasp that the rest have similar fervor just like my own to grasp more and more with reference to this condition. Certainly there are millions of more enjoyable situations ahead for those who go through your blog.

  21. adidas ultra说道:

    Thank you a lot for providing individuals with an exceptionally superb opportunity to read from this web site. It's usually very enjoyable and jam-packed with a great time for me and my office mates to search your site at the very least thrice every week to learn the newest stuff you will have. And indeed, I am also at all times pleased with all the fabulous secrets you serve. Selected 4 facts in this posting are definitely the finest we've had.

  22. nike hyperdunk说道:

    I in addition to my pals ended up looking at the great helpful tips on your web blog while immediately came up with a horrible feeling I never expressed respect to the web blog owner for those strategies. All of the boys happened to be absolutely excited to learn them and already have pretty much been taking advantage of those things. Thanks for genuinely considerably considerate and then for deciding upon this form of superior resources millions of individuals are really desirous to be informed on. Our sincere apologies for not saying thanks to you earlier.

  23. red bottom shoes说道:

    Thanks a lot for giving everyone an extremely wonderful chance to check tips from this website. It can be very cool and packed with amusement for me personally and my office acquaintances to visit the blog at the least thrice in one week to find out the fresh guides you have. And definitely, I am actually amazed with all the breathtaking hints you give. Certain two ideas in this article are in truth the most beneficial we have ever had.

  24. moncler说道:

    I enjoy you because of all your efforts on this blog. My aunt enjoys conducting internet research and it's easy to understand why. A lot of people learn all of the compelling method you present practical solutions via your website and as well recommend participation from some others on that article while our favorite girl is always becoming educated a lot. Enjoy the rest of the new year. You're carrying out a great job.

  25. fila shoes说道:

    I wish to express some thanks to this writer for rescuing me from this dilemma. Just after exploring through the world wide web and seeing tips which were not helpful, I thought my entire life was done. Living minus the approaches to the problems you have solved through this site is a critical case, as well as the kind which may have in a negative way affected my entire career if I had not come across your site. The training and kindness in controlling every part was precious. I am not sure what I would have done if I had not come across such a stuff like this. I am able to at this time relish my future. Thanks a lot so much for the reliable and result oriented guide. I won't hesitate to suggest your web site to any person who needs guidance on this problem.

  26. lebron 10说道:

    Thank you so much for providing individuals with remarkably nice possiblity to read articles and blog posts from this blog. It's usually very brilliant and as well , full of amusement for me personally and my office friends to visit your site at a minimum thrice a week to see the newest issues you will have. And indeed, I'm usually astounded with your cool tips served by you. Some 3 facts in this posting are undoubtedly the finest I've ever had.

  27. nike epic react说道:

    I wish to point out my admiration for your kindness for those people that really want guidance on this important content. Your real dedication to getting the message across had become particularly valuable and has constantly encouraged individuals just like me to get to their ambitions. This important help and advice denotes a whole lot to me and especially to my peers. With thanks; from everyone of us.

  28. My husband and i ended up being absolutely glad when Peter managed to do his investigation through your precious recommendations he grabbed from your site. It's not at all simplistic to just possibly be handing out tactics people today may have been making money from. Therefore we remember we have got the blog owner to thank because of that. The entire illustrations you have made, the simple blog menu, the friendships you help promote - it is all astounding, and it's really leading our son and the family reason why that subject matter is satisfying, which is tremendously important. Many thanks for the whole lot!

  29. off white hoodie说道:

    Thank you for every one of your work on this website. Ellie really likes conducting investigation and it's really easy to understand why. My spouse and i notice all about the lively way you produce very important tips and hints on this web blog and therefore recommend response from some other people on this point while our favorite simple princess is actually studying a whole lot. Have fun with the rest of the new year. You are doing a stunning job.

  30. ferragamo belt说道:

    I have to show some thanks to the writer for rescuing me from this type of challenge. After surfing around through the search engines and obtaining recommendations which are not beneficial, I assumed my entire life was gone. Living minus the approaches to the problems you've solved by means of the short article is a serious case, as well as those which might have adversely affected my entire career if I hadn't encountered your blog. Your primary natural talent and kindness in touching a lot of stuff was important. I am not sure what I would've done if I hadn't come upon such a stuff like this. I'm able to at this time relish my future. Thanks very much for this impressive and effective guide. I won't be reluctant to refer your web page to any individual who ought to have direction on this area.

  31. adidas tubular说道:

    I precisely needed to appreciate you again. I do not know what I could possibly have made to happen without those creative concepts documented by you regarding such a question. It actually was a very intimidating case in my opinion, but noticing the very well-written form you solved that forced me to cry with delight. I am just thankful for the information and even trust you really know what a great job you were doing teaching men and women with the aid of your websites. I'm certain you haven't encountered any of us.

  32. Needed to write you a very little word just to thank you so much as before just for the striking thoughts you've documented here. It is certainly unbelievably generous with you to deliver extensively exactly what many individuals would have sold as an e-book to help make some money for themselves, mostly considering the fact that you could possibly have tried it if you wanted. These basics as well worked to be a good way to be certain that other individuals have the same interest really like my personal own to figure out great deal more when considering this condition. I am certain there are many more fun periods in the future for individuals who view your blog post.

  33. yeezy boost 350说道:

    I'm just commenting to make you know what a brilliant discovery my friend's girl undergone using the blog. She picked up many things, not to mention what it's like to possess an excellent giving mindset to get many others smoothly grasp some very confusing matters. You actually surpassed her expected results. Many thanks for offering those essential, trusted, edifying as well as easy tips about that topic to Lizeth.

  34. Thank you so much for giving everyone an extremely pleasant opportunity to read articles and blog posts from this web site. It is usually very lovely and as well , jam-packed with a great time for me personally and my office mates to visit your web site on the least three times every week to read the newest tips you will have. Not to mention, we are at all times satisfied with the powerful solutions you give. Certain 1 ideas in this post are without a doubt the most effective we've ever had.

  35. kobe shoes说道:

    Thank you so much for providing individuals with a very remarkable opportunity to read critical reviews from this site. It is often so kind and as well , jam-packed with a great time for me and my office co-workers to visit your blog at minimum thrice per week to learn the fresh guides you have got. Not to mention, I am also at all times contented for the breathtaking secrets you serve. Certain 4 ideas in this posting are indeed the simplest we have all had.

  36. yeezy boost说道:

    Thank you a lot for giving everyone an exceptionally breathtaking possiblity to read in detail from this blog. It really is very pleasing and as well , stuffed with a good time for me and my office mates to visit your web site the equivalent of 3 times per week to learn the latest guidance you have. Of course, I'm always amazed with the striking pointers you give. Some 1 facts in this post are unquestionably the most impressive I have had.

  37. adidas yeezy说道:

    I precisely needed to say thanks yet again. I am not sure the things I would've made to happen in the absence of the actual creative ideas documented by you concerning this theme. It became a very terrifying dilemma for me personally, however , witnessing the specialized mode you treated that took me to weep over delight. I'm just happier for the service and as well , sincerely hope you really know what an amazing job you have been getting into educating men and women through your websites. Probably you've never met all of us.

  38. yeezy shoes说道:

    I in addition to my friends came looking at the great things located on your website while all of the sudden got an awful feeling I had not thanked the web blog owner for those strategies. All of the young boys came for this reason happy to learn them and now have actually been using them. Many thanks for turning out to be quite thoughtful and for selecting this sort of ideal subject areas most people are really needing to discover. Our sincere apologies for not expressing gratitude to you sooner.

  39. My spouse and i got now cheerful Albert could do his inquiry out of the precious recommendations he came across out of the web pages. It's not at all simplistic to just happen to be releasing thoughts most people might have been selling. We really consider we have the writer to be grateful to for that. The main explanations you made, the straightforward website menu, the relationships you will help to instill - it is many incredible, and it's really making our son in addition to our family reckon that that subject is enjoyable, which is unbelievably important. Thank you for all!

发表评论

电子邮件地址不会被公开。 必填项已用*标注