Introduction to CSRF

Presented at RVAsec 2019, May 23, 2019, 11:10 a.m. (50 minutes).

An introduction to Cross Site Request Forgery, how to exploit it, and prevent it. The talk will begin with an introduction to Cross Site Request Forgery, defining what it is, how to exploit, how to prevent it.  Live demonstrations (if the demo gods cooperate) will be used during the presentation.  The talk concludes with an example of using Flash to bypass the mistaken protections offered by Cross Origin Resource Sharing.

Presenters:

• Aaron Bishop - SecurityMetrics, Inc.
  bISHop has been in the security realm for over 10 years, focused on penetration testing for 6 years.  If bISHop is not at a computer, he can often be found in the mountains with his dog.

Links:

• https://rvasec2019.sched.com/event/OCBi/introduction-to-csrf
• https://infocon.org/cons/RVAsec/RVAsec 2019/Aaron Bishop - CSRF 101.mp4
• https://infocon.org/cons/RVAsec/RVAsec 2019/Aaron Bishop - CSRF 101.eng.srt (subtitles)

Similar Presentations:

• The Next HOPE (2010) / Surf's Up! Exploring Cross Site Request Forgery (CSRF) through Social Network Exploitation
• ToorCon San Diego 18 (2016) / CSRF in the Modern Age: Sidestepping the CORS Standard
• ToorCon San Diego 18 (2016) / The Subtleties of Bypassing the Same-Origin Policy and Exploiting Cross-Site Request Forgery