A common parameter that may be required is a date or timestamp, which poses a
unique problem for the attacker. A timestamp would generally not be used as a protection
against CSRF attacks, but it could inadvertently prevent attacks using static links or
HTML forms. Timestamps can be easily faked using a JavaScript-based attack, which
generates a request dynamically either using the local victim??™s system clock or by
synchronizing with a clock controlled by the attacker.
Craft Your Attack??”Reflected CSRF As with cross-site scripting, an attacker can use two
delivery mechanisms to get the CSRF code to execute in a victim??™s browser: reflected and
stored CSRF.
Chapter 3: Cross-Domain Attacks 79
As with XSS attacks, reflected CSRF is exploited by luring the unsuspecting victim to
click a link or navigate to a web site controlled by the attacker. This technique is already
well understood by fraudsters conducting phishing attacks, and the thousands of
individuals who have fallen prey to these scams demonstrates the effectiveness of wellcrafted
fraudulent e-mails and web sites in fooling a vast number of Internet users.
The most basic reflected CSRF attack could be a single link performing a dangerous
function embedded in a SPAM e-mail.
Pages:
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173