ONE$ && ZER0$

I previously explained what is CSRF  and how we can mitigate a CSRF attack using Synchronizer token pattern technique. In this blog post I'm going to talk about another CSRF mitigation technique called "Double Submit Cookies Pattern"  😉 What is Double Submit Cookies Pattern? This is a technique, that sends a random seed or a "token" as we call it, in both a cookie and as a request parameter, with the server verifying if the cookie value and the request value match. Why DSCP? Now its obvious that a third party entity cannot perform a CSRF attack without the CSRF token, and in here attacker or the third party entity cannot get the token because its in a cookie, and third party web pages cannot retrieve cookies from another web page that has a different domain. For example, assume that the genuine web page is banker.com, and the attacker's web page is attacker.com, when a user logged in to the banker.com, and accidentally redirect to attacker

AJAX, short for Asynchronous Javascript And XML is a set of web development techniques that allows web pages to be updated asynchronously by exchanging data with a web server behind the scenes. This is simply a modification of a web page, without reloading it. In modern implementations, developers commonly utilize JSON instead of XML due to the advantage of JSON being native to javascript. AJAX is not a programming language, but a combination of browser build in XMLHttpRequest object, Javascript and HTML.  So in this word AJAX, as i previously mentioned, it means " Asynchronous Javascript And XML". In here, Asynchronous means, in the background or not requiring a page refresh. You all know what's "Javascript" means 😅. XML is a data format that very similar to JSON.  So, as i mentioned earlier, modern development is using JSON rather than XML when it comes to AJAXs. So I guess we can call this as AJAJ - Asynchronous Javascript And Jason,  because

In the previous blog post about cross site request forgery AKA CSRF , I discussed about the basics about CSRF, what it does and some mitigation techniques. Among those techniques, in this blog post I’m going to talk about the Synchronizer Token Pattern and its flow when exchanging CSRF token. What is Synchronizer Token Pattern? This is a technique where a unique secure string value, also known as a CSRF token, will embedded by the web application in all HTML forms and verified on the server side in each state changing requests. The token may be generated by any method that ensure uniqueness, unpredictability and security so that any attacker would not be able to place the correct token along with the request. Why STP? A third party attacker cannot perform a CSRF attack, because cross domain AJAX calls are not possible. This means, the victim is in banker.com, and attacker.com cannot request the CSRF token  from the server via an ajax, because the domain doesn'

What is this? ❓ Cross-Site-Request-Forgery in simple terms CSRF is an attack type that forces users to execute unwanted actions on a web application (typically a web page) in which they are currently authenticated. CSRF attacks specifically target state changing operations. An attacker can trick legitimate users of a legitimate web application into executing actions of the attacker’s choosing. A successful CSRF attack can perform state changing requests like transferring funds, changing statuses and so forth. A CSRF attack inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf. For most sites, the web browser request any credentials associated with the site, such as the user’s session cookie and all. Therefore, if a user currently authenticated to a site, the site cannot identify the difference between the legitimate requests sent by the victim and forged requests sent by the victim. (Attacker's request) For

In previous blog posts about OAuth 2.0  and  OAuth Grant Types  I discussed about the basic idea of OAuth 2.0 framework and the four main grant types of retrieving an access-token. Comparing all four grant types, you can see that the "Authorization code" grant type is somewhat complex than the other three grant types. So, I thought about developing a simple web based java application just to demonstrate the message passing (requests and responses) flow of  OAuth 2.0 Authorization code grant type. Again, if you are not familiar with OAuth 2.0 framework or its grant types, visit my blog posts about, OAuth 2.0  OAuth 2.0 Token Grants   😊 As I was saying, I developed an application to demonstrate the flow of authorization_code grant, and I used JAVA as the language, Apache Maven as the building tool and Apache Tomcat as the web server. Lets see how this works. 😉 As you remember, the first thing to do as a client is to get the authorization code. To do that the cli