Jump to content

Recommended Posts

Posted

Τι είναι το Cross-Site Request Forgery ή αλλιώς CSRF ή XSRF ?

Είναι ένα είδος επίθεσης η οποία γίνετε ως εξής....

O Admin Κάνει Login

 

2qda2o1.png

 

Username: admin

Password: admin

 

29xvvc2.png

 

π.χ. ο admin θέλει να αλλάξει τον κωδικό του σε κάτι ποιό δύσκολο

 

35bt8qp.png

 

qsoyex.png

 

Ο admin μπορεί να μην είδε ότι στο URL υπάρχει η εντολή

password_new=test&password_conf=test&Change=Change

Τι μπορούμε να καταλάβουμε απο το URL

1) Μπορείς να αλλάξεις τον κωδικό απο εκεί

2) Δεν χρειάζεται Username ή κάτι τέτοιο οπότε πιάνει για όλους τους χρήστες που πηγαίνουν στο URL

 

Άν όμως το παρατηρούσε ένας "Hacker" την ώρα που άλλαζε τον κωδικό του ?

Τι θα κάνατε στην θέση του... ?

Θα σας πώ τι θα έκανα εγώ

1) Θα έπερνα το URL και θα το άλλαζα απο

 

http://127.0.0.1/dvwa/vulnerabilities/csrf/?password_new=test&password_conf=test&Change=Change#

 

http://127.0.0.1/dvwa/vulnerabilities/csrf/?password_new=Hacked&password_conf=Hacked&Change=Change#

 

Tώρα είναι το θέμα πώς θα "αναγκάσουμε" τον Admin να το πατήσει...

Ας πούμε ότι ήταν Admin σε αυτό το φόρουμ

Θα μπορούσαμε να κάνουμε αυτό

 

Press Here!

 

Όταν το πατήσει ο admin

 

6ig1up.png

 

Αν προσπαθήσει να κάνει Login με το κανονικό του Username Και Password

Username: admin

Password: test

(Αφού τον αλλάξε πρίν)

 

 

e6uee9.png

 

Login Failed!

 

11uuaec.png

 

Αν δοκιμάσει ο Hacker να κάνει Login όμως...?

 

2vdha8x.png

 

Πλέον είναι αυτός admin

 

29xvvc2.png

 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Posts

    • TG Support: https://t.me/buyingproxysup | Channel: https://t.me/buyingproxycom Discord support: #buyingproxy | Server: Join the BuyingProxy Discord Server!  Create your free account here
    • Dalam World — This is a new gaming project that brings together all the mechanics of your favorite games! I want to say right away that the game will run on all devices: Windows, Linux, macOS (Intel/Apple)! The Dalam World client features advanced graphics that will look great! The client also provides stable FPS even with a huge number of players! Dalam World is not a Salve or Chronicle client ported upward — it’s a completely remade game on its own proprietary game engine! Dalam World servers allow more than 100,000 people to exist in a single world without virtual instances, thanks to server technologies built with Elixir and Rust! Dalam World is the childhood game we love so much! From each of our favorite MMOs we took only the best elements! Low system requirements will let the game run on an old laptop! We redesigned the game so there are no bots or real-money traders! Game website: https://Dalam.World Game forum: https://Dalam.World/forums/ For arbitragers: https://careers.dalam.world/ Discord: https://discord.gg/vbQ347nuxd Telegram: https://t.me/+u1DNZPzscaRmNjYx Opening July 16, 2026 at 16:00 UTC!  
    • I'll give you my wallet if you want, haha
    • To make up for some of the waiting time we’re hosting a 3v3 Tournament on open Beta, and this time we’re raising the stakes with a $1,300 prize pool 💰   🏆 PRIZE POOL BREAKDOWN (Over 2000$ Worth of prices total)   🥇 1st Place — $700 🥈 2nd Place —$300 🥉 3rd Place — $200 🏅 4th Place — $100  5th -6th Place - $100 in Gold Coins each    All Participating Teams: $50 in Gold!   All Prices will be Paid out instantly after the tour, no waiting time and conditions. This is not simply a marketing move, we want to give back to the community.   📅 Date: Wednesday 06.05.2026 ⏰ Time: 20:00 Central European Timezone (Berlin) 📍Format: 3v3   ⚔️Why join? Cash Prices for top 4 and rewards for all participants Payments to winners sent out straight after the tournament - No waiting time or rules that you have to play live server to obtain the reward. Clean format, smooth matches, and solid prize pool and a chance to experience our brand new files   📝How to join: Form your 3-player team Group Leader Sign up here: ⁠📍・3v3-tour-registration (Include Name of Group, Name of Group Leader)   Be ready on match day!     A separate post with rules for the tournament and class setups will follow shortly.   Tag your teammates, lock in your roster, and get ready to compete. We'll be happy to see you on the OBT!   💬 Questions? Ask in ⁠🎫・ticket or send us a message   See you on L2Dark! 😏   Discord: https://discord.gg/FAJwnFpb8M
    • You should check if that condition is supported by your current sources. You can find this in  DocumentBase#parsePlayerCondition If it isnt there and you want to follow the same pattern of the other item conditions, create a custom condition to parse the classId (or multiple class ids) (there are examples to copy the code). Alternatively, you can create your own condition handler. Your condition should look like this: <cond msgId="1518"> <or> <player classId="ADVENTURER" /> <player classId="PALADIN" /> </or> </cond> or <cond msgId="1518"> <or> <player classId="93" /> <player classId="5" /> </or> </cond>  
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..