SecGen/scenarios/labs/web_security/6_csrf.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

    <name>Cross-Site Request Forgery</name>
    <author>James Davis</author>
    <description>
# Introduction
In this web security lab focused on Cross-Site Request Forgery (CSRF), you will delve into the intricacies of a prevalent attack that exploits the trust websites have in their users. CSRF, also known as session riding, involves users unknowingly sending requests to services they are logged into, utilizing their session cookies and other identifying information. The lab employs resources such as Damn Vulnerable Web App (DVWA), OWASP WebGoat and WebWolf, and CTF via OWASP Security Shepherd. The theoretical foundation covers the distinction between XSS and CSRF, emphasizing CSRF's exploitation of user trust to execute state-changing transactions. The lab introduces you to tools like Zap and WebWolf, guiding you through various exercises in WebGoat and DVWA to simulate and understand CSRF attacks at different security levels.

Throughout the lab, you will engage in hands-on tasks that mirror real-world scenarios. For instance, you'll create an external form using vi text editor, host it with WebWolf, and understand the parameters necessary for a POST request. In DVWA challenges, you'll manipulate HTML forms to exploit vulnerabilities at low, medium, and high security levels. The tasks also extend to combining CSRF with XSS to overcome anti-CSRF measures. By the end of the lab, you'll have a comprehensive understanding of CSRF attacks, CORS limitations, and practical skills in executing and defending against such attacks, enhancing your expertise in web application security.
    </description>
    <lab_sheet_url>https://docs.google.com/document/d/1ABryiNKLDiIG6i7PQUztzzynjPo3fRSBP4OakxCPraY/edit?usp=sharing</lab_sheet_url>

    <type>lab-environment</type>
    <type>ctf-lab</type>

    <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
        <keyword>cookies</keyword>
        <keyword>JAVASCRIPT</keyword>
        <keyword>HYPERTEXT MARKUP LANGUAGE (HTML)</keyword>
        <keyword>HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING</keyword>
        <keyword>DATABASE</keyword>
        <keyword>SESSION HIJACKING</keyword>
        <keyword>CLIENT-SERVER MODELS</keyword>
    </CyBOK>
    <CyBOK KA="WAM" topic="Client-Side Vulnerabilities and Mitigations">
        <keyword>client-side storage</keyword>
        <keyword>CLIENT-SIDE VALIDATION</keyword>
        <keyword>clickjacking</keyword>
    </CyBOK>
    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
        <keyword>injection vulnerabilities</keyword>
        <keyword>server-side misconfiguration and vulnerable components</keyword>
        <keyword>CROSS-SITE SCRIPTING (XSS)</keyword>
        <keyword>CROSS-SITE REQUEST FORGERY (CSRF)</keyword>
        <keyword>CONFUSED DEPUTY ATTACKS</keyword>
        <keyword>BACK-END</keyword>
    </CyBOK>
    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
        <keyword>Web vulnerabilities / OWASP Top 10</keyword>
    </CyBOK>
    <CyBOK KA="SS" topic="Prevention of Vulnerabilities">
        <keyword>coding practices</keyword>
        <keyword>Protecting against session management attacks, XSS, SQLi, CSRF</keyword>
    </CyBOK>
    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
        <keyword>dynamic detection</keyword>
    </CyBOK>

    <system>
        <system_name>web_server</system_name>
        <base distro="Debian 10 Buster amd64" />

        <input into_datastore="IP_addresses">
            <!-- 0 web_server -->
            <value>172.16.0.2</value>
            <!-- 1 kali -->
            <value>172.16.0.3</value>
        </input>

        <utility module_path=".*/parameterised_accounts">
            <input into="accounts">
                <generator type="account">
                    <input into="username">
                        <value>shepherd</value>
                    </input>
                    <input into="password">
                        <value>tiaspbiqe2r</value>
                    </input>
                    <input into="super_user">
                        <value>false</value>
                    </input>
                </generator>
            </input>
        </utility>

        <vulnerability module_path=".*/security_shepherd">
            <input into="modules">
                <generator type="ss_modules">
                    <input into="filter">
                        <value>CSRF</value>
                    </input>
                </generator>
            </input>
            <input into="unix_username">
                <value>shepherd</value>
            </input>
            <input into="flag_store" into_datastore="flag_store">
                <generator type="flag_generator" module_path=".*base64">
                    <input into="iterations">
                        <value>8</value>
                    </input>
                </generator>
            </input>
        </vulnerability>

        <input into_datastore="spoiler_admin_pass">
            <generator type="strong_password_generator"/>
        </input>
        <build type="cleanup">
            <input into="root_password">
                <datastore>spoiler_admin_pass</datastore>
            </input>
        </build>

        <utility module_path=".*/hosts">
            <input into="hosts">
                <value>webserver</value>
                <value>kali</value>
            </input>
            <input into="IP_addresses">
                <datastore access="0">IP_addresses</datastore>
                <datastore access="1">IP_addresses</datastore>
            </input>
        </utility>

        <network type="private_network">
            <input into="IP_address">
                <datastore access="0">IP_addresses</datastore>
            </input>
        </network>
    </system>

    <system>
        <system_name>kali</system_name>
        <base distro="Kali" name="MSF" />

        <input into_datastore="kali_account">
            <value>
                {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
        </input>

        <utility module_path=".*/parameterised_accounts">
            <input into="accounts">
                <datastore>kali_account</datastore>
            </input>
        </utility>

        <vulnerability module_path=".*/dvwa" />

        <vulnerability module_path=".*/webgoat">
            <input into="port">
                <value>8085</value>
            </input>
        </vulnerability>

        <utility module_path=".*/kali_web" />

        <utility module_path=".*/iceweasel">
            <input into="accounts">
                <datastore>kali_account</datastore>
            </input>
            <input into="autostart">
                <value>true</value>
            </input>
            <input into="start_page">
                <value>http://localhost:8085/WebGoat|webserver</value>
            </input>
        </utility>

        <utility module_path=".*/hosts">
            <input into="hosts">
                <value>webserver</value>
                <value>kali</value>
            </input>
            <input into="IP_addresses">
                <datastore access="0">IP_addresses</datastore>
                <datastore access="1">IP_addresses</datastore>
            </input>
        </utility>

        <build type="cleanup">
            <input into="root_password">
                <datastore>spoiler_admin_pass</datastore>
            </input>
        </build>
        <network type="private_network">
            <input into="IP_address">
                <datastore access="1">IP_addresses</datastore>
            </input>
        </network>
    </system>

</scenario>