3 ms·
Step 1. Send Gmail user an email for some free Porn, Get Rich quick, etc Step 2a. Ask them to create a username/password for their free Porn Step 2b. Use the
by sh1mmer 18y ago
Step 1. Send Gmail user an email for some free Porn, Get Rich quick, etc
Step 2a. Ask them to create a username/password for their free Porn
Step 2b. Use the password to change their Gmail account login, download all their other account information and lock them out.
Step 3. Steal all the money from their bank account using the information from their Gmail account
Alternatively:
Step 1. As above
Step 2a. Show the user lots of free porn, etc to keep them on your site.
Step 2b. Do a scripted dictionary attack against the user's account to change their password using their cookies.
Step 3. As above
The essential point here is that using a non-cookie session based url identifier for things that change the state of a user's account is a must. At Yahoo! we call it a "crumb". Essentially print a unique (at least to the user) and verifiable key on your pages. Check for that key before accepting any requests to change stuff.
E.g:
Linking document
<?php
//This should really be a chunk from /dev/random
$secret = 'unicorns';
$time = time();
setcookie("timestamp", $time);
$crumb = sha1($secret . $time);
?>
<a href="doAmazingStuff.php?crumb=<?=$crumb?>">Do Amazing Stuff</a>
Action Document
<?php
$secret = 'unicorns';
if (isset($_GET['crumb'])) {
$crumb_val = sha1($secret . $_COOKIE['timestamp']);
if ($_GET['crumb'] == $crumb_val) {
amazingStuff();
} else {
showError('Crumb is invalid');
}
} else {
showError('No crumb to validate');
}