Web App Penetration Testing - #13 - CSRF (Cross Site Request Forgery)

Hey guys! HackerSploit here back again with another video, in this video, I will be demonstrating how to perform CSRF with BurpSuite on OWASP Juice Shop.
OWASP Juice Shop: www.owasp.org/...
⭐Help Support HackerSploit by using the following links:
🔗 NordVPN: nordvpn.org/ha...
Use the link above or the code below for 77% Off your order
Promo Code: hacker
Patreon: / hackersploit
I Hope you enjoy/enjoyed the video.
If you have any questions or suggestions feel free to ask them in the comments section or on my social networks.
🔗 HackerSploit Website: hsploit.com/
🔗 HackerSploit Android App: play.google.co...
🔹 Support The Channel
NordVPN Affiliate Link: nordvpn.org/ha...
Patreon: / hackersploit
🔹 Get Our Courses
Get a special discount on our courses:
The Complete Deep Web Course 2018:
www.udemy.com/...
🔹 SOCIAL NETWORKS - Connect With Us!
-------------------------------
Facebook: / hackersploit
Instagram: / alexi_ahmed
Twitter: / hackersploit
Patreon: / hackersploit
--------------------------------
Thanks for watching!
Благодаря за гледането
Kiitos katsomisesta
感谢您观看
Merci d'avoir regardé
Grazie per la visione
Gracias por ver
شكرا للمشاهدة
دیکھنے کے لیے شکریہ
देखने के लिए धन्यवाद

[@kaushikumang]

Just for your information: your voice and videos sometimes don't sync. It scares some people. Although great videos man, keep it up.

[@chethanb6406]

yes he has to do something about it

[@jibberjabber6919]

They get scared of out of sync audio/video?! 🤣🤣🤣

[@user-tt9lu5nw1p]

Yes it's a bit delayed, but still great video. He is doing a great work. Give him time.

[@venkateshkomati2618]

It's great; able to understand what the csrf is from this video. i also feel you can do some improvement; you should have used two different sites to show how the end user clicks a link or image etc.. from a different site when he still logged in to the vulnerable site and how the csrf actually working; it will give a real world experience I am enjoying your lectures

[@m12652]

8 minutes in and you’ve dragged out what should have taken less than a minute...

[@graciousemmanuel6142]

Nice video, detailed explanation. I learnt CSRF on portswigger. I think i prefer your own method of attack. Portswigger method requires you to create an HTML form with the hidden field you wish to changed and a JavaScript to execute the the onsubmit function. Though their method would go easily for both GET request and Post request, while yours is for GET request. Thanks Alex(hackersploit).

[@dhaiwatmehta2323]

Do you see or check your video before uploading ? If yes then there's some problem with sound and video mismatch...

[@armaansameer8171]

Love youre voice Mann😆😂

[@shadow_self8564]

What to laugh for in that?

[@elviraeloramilosic9813]

Beautiful job! 🏆✔️ Yes, owasp please.

[@hackerstech4025]

Hi cute

[@hippolytereynalus2867]

when i put a script in the search bar, I only obtain a No result found for the search

[@chieduodo1292]

Great content! Please make a video showing how to set up owasp juice shop. Thanks

[@Karan-wv9zn]

Great video brother make more of it...# first

[@attscham7820]

well done, made it very easy to understand. shortcodes are tricky!

[@Anandhpt]

not able to run script even the alert one can anyone help ?

[@alexandruarvinte523]

I love watching your videos !! very informative , keep it up !

[@slim__emm]

You can also see it in inspect element -> network -> xhr how request was sent

[@fairchild9able]

Love your work sir.Thank you. Keep it up!

[@shakirali3647]

Yes make a video on OWASP juice shop walkthrough

[@antoine9704]

yeah please

[@anhedonus4817]

Please do cover the entire CTF juice shop web application, when you have time.Thank you very much for the videos.Have a nice day,sir!

[@cybercovert]

Please make a review of CCNA Cyber Ops course. And also keep doing this good stuff with the burp, as its an industry tool and more closer to practical environment.

[@BhootFmOfficial786]

Good to hear your Voice

[@richardcoleman4686]

Really good video. Excellent delivery. Thanks for sharing.

[@issammbarek78]

best CSRF explanation ever

[@bertrandfossung1216]

Thanks for this video @Hackersploit. Please kindly make a video of how to set up Owasp Juice shop. 🙏

[@shubhamghosh2228]

We love your voice more than your tutorials 😂😂 Sorry for that 🤣

[@allTimeFavorite]

Great video!! I would love to see some more Juice Shop videos.

[@Sam-rz5hw]

Thanks this is what I wanted , you are amazing

[@supersaiyan0x016]

Awesome vedio...learnt something new...Keep up your good work 😍 Thanks for sharing your knowledge 💜

[@syedhussain2656]

Hey Bro I don't want ti discouraged you. But my question is that what is the exact entry point for csrf. 2. Why you using script It supposed to be a form field.

[@YourMom-rg5jk]

Great video! Explained clearly, to the point.

[@faique2995]

Please sir make a video on setuping up OWASP JUICE SHOP.

[@antiquark6253]

Excellent video, love these

[@ICOFRITE]

Another great video! Going to get juice shop!

[@cyberninja2816]

hi I used latest juice shop 12.7.2 and script attack didn't work on search bar @HackerSploit? what do I do ?

[@ishajoshi4599]

same here :(

[@killinghawkz]

try using the old one?

[@rukunuddinsiddique4704]

Thanks sir .. I appreciated your effort

[@TheGenexSecurity]

Another great easy to follow tutorial!

[@legendarygamers1703]

Love from India . ❤

[@pauraspatil9314]

Thanks man for the awesome content!!

[@ajaydahiya4651]

Very well explained sir. 👍👍

[@adamkadaban]

Yes, please show us how to set up Jucie shop

[@Remo773T-Bag]

nice tutor, thats why i love ur all videos...💛

[@subbarayudu118]

Great video 👍

[@bryanchen7404]

20:40 pass123 is the old password, and it logs in...so it doesn't actually work

[@systemWebops]

script alert is not working plus xmlhttp is also not working wht to do it shows no results found i am using juicebox v11

[@ahead725]

Same problem

[@ericmoore4515]

Nice!! If you follow these in order, the right process to pentest a site?

[@manisekar2884]

brilliant explanation

[@flimedits8195]

Why Can't We Intercept The Request Of HTTPS Site ? Love Your Videos😙 1st Comment

[@thedawnofslayer]

Because of the Certificate Authority (CA) but, you can circumvent this situation installing the burp CA (burp). Download the CA and install it in your browser. Once done, you can intercept HTTPS communications.

[@AD-zg9id]

Cool! Is it also possible to utilize this attack in the form of a persistent XXS? That way you would not need the emails of the users and it would expand the likelihood of the attack to succes. Thanks!

[@JoshuaPhilipJha]

What if it shows a 302 Found I am not able to login using the credentials showed in burp

[@panchcw]

great brother.nice explanation

[@college3848]

Thanks Bro....As always u r the best.....👌👌👌👌

[@Psymella]

Amazing video!

[@3N18AKPzmGOsBgWKH]

Out of curiosity. Will this all be logged on the website. Loke.. Let's say they are logging stuff on the website and you create this URL script. Will one be able to see the difference on the logs in the website?

[@kevinvdvdv2737]

Do you have to use softwares to find these CSRF vunerablities?? Or you have to find them using manual methods??

[@maurolsmoura]

Very interesting

[@brendanortiz1742]

@HackerSploit for this video or maybe successive videos can you show how you would maybe extract user name/email information doing something like this? Or setting it up maybe in the comment section on the website or something?

[@failhuman5944]

i like your teching

[@danny06969]

For some reason in Burpsuite, I don't get the GET request for the changing of passwords. I only get the POST request. So I can't get to the point of manipulating it. Any ideas?

[@adityakiddo6554]

Use the repeater , you can modify any request ... 2023 answer

[@danny06969]

@@adityakiddo6554 Awesome I have been waiting 4 long years for an answer thank you!

[@wannabe6615]

For me it's painful to have to see audio mismatched from the video

[@devedroy]

This was awesome.

[@tilakTilak08]

Hey can u make the vedio how to set up juice shop as well.....thanks in advance

[@pranavkharwar125]

keep making videos like this you the best

[@HackerSploit]

Thank you, will do.

[@tomcherian1256]

Thanks

[@AbhishekKumar-kt6yp]

Does this attack works on post request

[@payl04d23]

Nice!

[@dhanashreedeshpande7100]

Please tell us -- How this attack can be identified in access log file?

[@kkaja3398]

Hi If website dont have input fields like search button what should we do

[@jepunband6280]

Hi hackersploit, love your tutorials. Would it be possible to do a tutorial on tool like xsser. Thanks

[@arbazfarooqi5050]

great work !!

[@g.s.sdheeraj5706]

yes please do a video on it

[@fanoflego456]

Burp is picking up everything except my Juice Shop, how do I go about fixing that?

[@muhammadmughal4258]

tell me one thing, can we do it on POST Method? how then we may craft a link?

[@reynoldcracker02]

I made a website miself and test the attack against a php script that suppose to receive the data through some input and when I create the fake webpage and click the submit button. The data pass through original website php script as I would be the user who send the data. That is huge

[@bharatkumartajwani8626]

sir i have installed the juice shop and i have window os than how can i do this cross site request forgery?

[@nabeelnajeeb8]

hey! im facing an issue with installing nodejs and subsequently juice shop as well, esp with their latest versioning. could you please help me out? thanks in advance! :)

[@harendrayadav3857]

Dear Hackersploit world, I have a mi note 4 device Whenever i start a meterpreter session on it, It works like a charm except one thing. I was unable to dump the messages from notifications tab as this phone has two things in its messages tab. One the usual messages that i sent and recieve another is notifications tab that includes the messages of promos from mu carrier and banks. How come These messages from notifications are not dumping. Kindly go through it.

[@caiooliveira9108]

hello, so the attacker website send a requests to the victim browser? how can that happen?

[@etutorshop]

I like your videos, it would help even more if you get to the crux of the matter a bit quicker.

[@payl04d23]

Hey Hackersploit, What if i hash the script, and enter the hash in the vulnerable search bar? would that work?

[@chuckynorris616]

Sounds like abdu from ownagepranks

[@CyberSecForce]

Nicely

[@bharath7050]

That's great, what part of code sanitization on https can mitigate csrf ??

[@RameshKumar-rt8xb]

but this method can't do much as websites these days have 2fa to change passwords

[@bharathhari4324]

Nice video 👍

[@TomJerry-zt2bp]

If the password is sending with POST form with encryption, then how to check CSRF?

[@gf384]

Thanks!

[@user-ek9ez7ho6f]

I have Burp Pro and Crack but I cant setup it on MacOS but it works in Kali - can someone help me to get PRO BURP on MacOS?

[@agentstona]

He took 20 mins to explain a 5 minute video .......lmao this guy knows how to talk for long ...

[@linuxvideoguy9475]

hmm for some reason I was not able to get the script to work. All the other steps worked no problem.

[@prabhuselva8228]

hey i cracked a website using phpid=1 and i got passowrd like this 2132f297af like this how to decode this clear my doubt as soon as possible waiting for ur reply

[@mihirshah1056]

U need not ask if we want you to make a video, we always want that, so please make a video of u feel like :)

[@ludgeromiguel8319]

amazing

[@techstudio2903]

Please make a video on juice shop download

[@finally_code]

I'm at minute 5 ... no content so far ... how is this possible ...

[@ademyilmaz2084]

one namber of in the world tnks

[@saurabhagrawal9421]

Please make a video on session hijacking

[@yusuususwwwdpppdeew6780]

Can u plzzzz make a video about empire

[@HackerSploit]

Yes

[@salvakhiraman244]

greate video ever

[@pak__key1574]

thanks!

[@Rossboe1]

Hi, My burp won't listen to port 3000? Any ideas people. Thanks

[@Rossboe1]

@Reyes25111 Ok cool. Cheers

[@Stenkyedits]

what did u do? i used 8080 in browser and burp but "localhost:300" isnt showing on targets

[@user-ek9ez7ho6f]

Make video of juice ctf

[@spoorthipanduranga9948]

Cant we perform with free version?.