Elvis Wiki - User contributions [en]

Practical CSRF example using Burp Suite

2020-01-31T21:41:27Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[2]

Additional Information:
The steps after the last picture are only possible if one has a Burp Suite Version higher than Community.

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF my seminar paper [[File: thesis.pdf]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:41:07Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[2]

Additional Information:

The steps after the last picture are only possible if one has a Burp Suite Version higher than Community.

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF my seminar paper [[File: thesis.pdf]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:40:20Z

Nmuehlberger:

Practical CSRF example using Burp Suite

2020-01-31T21:38:41Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF my seminar paper [[File: thesis.pdf]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:38:13Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg|500px]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF my seminar paper [[File: thesis.pdf]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:37:29Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [[File: thesis.pdf]seminar paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:36:57Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [[File: thesis.pdf Thesis]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:36:26Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [[File: thesis.pdf]] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:35:18Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [[File: thesis.pdf] Thesis] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:35:01Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [[File: Thesis.pdf] Thesis] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:34:33Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [Thesis.pdf Thesis] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

File:Thesis.pdf

2020-01-31T21:30:57Z

Nmuehlberger: Nmuehlberger uploaded a new version of File:Thesis.pdf

== Summary ==
Seminararbeit

Practical CSRF example using Burp Suite

2020-01-31T21:30:40Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery

[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-

[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html

[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:29:42Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:

[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]

[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:28:49Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful:
[https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]
[https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
* Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
* Open the Website using the address provided in the VM Ware
* Choose GetBoo
* Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
* Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
* Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
* Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
* In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
* In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
* Click "Copy HTML" in the same window
* Copy this HTML into a text editor and save it as a HTML ﬁle
* select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
* Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:26:53Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
[[File:StartBurp1.jpg]][[File:StartBurp2.jpg]]
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
[[File:ProxySettings.jpg]]
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.
[[File:InterceptOff.jpg]]

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
** Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
[[File:BrokenWebApp.jpg]]
** Open the Website using the address provided in the VM Ware
** Choose GetBoo
** Authenticate into the website with the credentials user:user
[[File:Login.jpg]]
** Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"
[[File:Modify1.jpg]][[File:Modify2.jpg]]
** Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".
[[File:InterceptOn.jpg]]
** Submit the request so Burp Suite is able to capture the data
[[File:Data.jpg]]
** In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC
[[File:CSRFPoc.jpg]]
** In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
** Click "Copy HTML" in the same window
** Copy this HTML into a text editor and save it as a HTML ﬁle
** select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
** Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

File:StartBurp2.jpg

2020-01-31T21:23:42Z

Nmuehlberger:

File:StartBurp1.jpg

2020-01-31T21:23:33Z

Nmuehlberger:

File:ProxySettings.jpg

2020-01-31T21:23:23Z

Nmuehlberger:

File:Modify2.jpg

2020-01-31T21:23:11Z

Nmuehlberger:

File:Modify1.jpg

2020-01-31T21:23:03Z

Nmuehlberger:

File:Login.jpg

2020-01-31T21:22:54Z

Nmuehlberger:

File:InterceptOn.jpg

2020-01-31T21:22:45Z

Nmuehlberger:

File:InterceptOff.jpg

2020-01-31T21:22:37Z

Nmuehlberger:

File:Data.jpg

2020-01-31T21:22:27Z

Nmuehlberger:

File:CSRFPoc.jpg

2020-01-31T21:22:17Z

Nmuehlberger:

File:BrokenWebApp.jpg

2020-01-31T21:22:07Z

Nmuehlberger:

Practical CSRF example using Burp Suite

2020-01-31T21:12:03Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application intentionally has a lot of vulnerabilities to explore.

Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
** Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
** Open the Website using the address provided in the VM Ware
** Choose GetBoo
** Authenticate into the website with the credentials user:user
BILD
** Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

** Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

** Submit the request so Burp Suite is able to capture the data

** In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

** In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
** Click "Copy HTML" in the same window
** Copy this HTML into a text editor and save it as a HTML ﬁle
** select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
** Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:10:15Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). This is an attack that tricks the end user to execute unwanted actions on a web application, like submitting a malicious request, in which they are authenticated at. In a browser request for most sites the user’s session cookie, IP address and Windows domain credentials, needs to be included. Because of that, it is impossible for the site to distinguish between a forged request of an attacker sent by the victim and a legitimate request of the victim. CSRF attacks target speciﬁcally state-changing requests, because the response to the forged request cannot be seen by the attacker. State-changing requests can be transferring funds, changing the e-mail address or password or purchasing items. This article shows how such an attack can be performed on an unsecure webpage by changing the e-mail address of a victim using Burpsuite.[1]

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
** Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
** Open the Website using the address provided in the VM Ware
** Choose GetBoo
** Authenticate into the website with the credentials user:user
BILD
** Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

** Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

** Submit the request so Burp Suite is able to capture the data

** In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

** In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
** Click "Copy HTML" in the same window
** Copy this HTML into a text editor and save it as a HTML ﬁle
** select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
** Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:09:14Z

Nmuehlberger:

== Introduction ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). It works through injecting HTML or similar code with malicious code and exploits the vulnerabilities based on the website trusting in the user’s requests.[1] This article shows how such an attack can be performed on an unsecure webpage using Burpsuite.

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
** Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
** Open the Website using the address provided in the VM Ware
** Choose GetBoo
** Authenticate into the website with the credentials user:user
BILD
** Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

** Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

** Submit the request so Burp Suite is able to capture the data

** In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

** In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
** Click "Copy HTML" in the same window
** Copy this HTML into a text editor and save it as a HTML ﬁle
** select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
** Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:09:01Z

Nmuehlberger:

== Introdutcion ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). It works through injecting HTML or similar code with malicious code and exploits the vulnerabilities based on the website trusting in the user’s requests.[1] This article shows how such an attack can be performed on an unsecure webpage using Burpsuite.

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
** Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
** Check the "Use this proxy server for all protocols" box
** Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
** Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
** Remember the download location
** Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
** Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
** Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
** After restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
** Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
** Open the Website using the address provided in the VM Ware
** Choose GetBoo
** Authenticate into the website with the credentials user:user
BILD
** Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

** Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

** Submit the request so Burp Suite is able to capture the data

** In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

** In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
** Click "Copy HTML" in the same window
** Copy this HTML into a text editor and save it as a HTML ﬁle
** select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
** Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:07:34Z

Nmuehlberger:

== Introdutcion ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). It works through injecting HTML or similar code with malicious code and exploits the vulnerabilities based on the website trusting in the user’s requests.[1] This article shows how such an attack can be performed on an unsecure webpage using Burpsuite.

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
** Menu - Preferences - Options - General - Network Proxy - Settings.
** Select "Manual proxy conﬁguration"
** Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
• Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
• Check the "Use this proxy server for all protocols" box
• Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
• Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
• Remember the download location
• Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
• Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
• Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
• after restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
• Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
• Open the Website using the address provided in the VM Ware
• Choose GetBoo
• Authenticate into the website with the credentials user:user
BILD
• Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

• Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

• Submit the request so Burp Suite is able to capture the data

• In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

• In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
• Click "Copy HTML" in the same window
• Copy this HTML into a text editor and save it as a HTML ﬁle
• select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
• Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T21:07:03Z

Nmuehlberger:

== Introdutcion ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). It works through injecting HTML or similar code with malicious code and exploits the vulnerabilities based on the website trusting in the user’s requests.[1] This article shows how such an attack can be performed on an unsecure webpage using Burpsuite.

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
• Menu - Preferences - Options - General - Network Proxy - Settings.
• Select "Manual proxy conﬁguration"
• Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
• Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
• Check the "Use this proxy server for all protocols" box
• Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[3]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
• Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
• Remember the download location
• Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
• Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
• Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
• after restarting Firefox it should be possible to open https-Websites while running Burp Suite[4]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

For anyone using a different browser than Firefox, the following to links will be helpful: [https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html Browser Configuration]; [https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html Certificate Installation]

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
• Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
• Open the Website using the address provided in the VM Ware
• Choose GetBoo
• Authenticate into the website with the credentials user:user
BILD
• Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

• Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

• Submit the request so Burp Suite is able to capture the data

• In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

• In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
• Click "Copy HTML" in the same window
• Copy this HTML into a text editor and save it as a HTML ﬁle
• select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
• Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

==References==
[1] https://www.owasp.org/index.php/Cross-Site Request Forgery
[2] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[3] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[4] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm
[[Category:Documentation]]

Practical CSRF example using Burp Suite

2020-01-31T20:59:21Z

Nmuehlberger:

== Introdutcion ==
As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent attackers from exploiting any vulnerabilities so the user’s credentials can be kept safe. As some vulnerabilities are not as widely known as they should be, although they are rather common, this article deals with one of these vulnerabilities called Cross-Site Request Forgery(CSRF). It works through injecting HTML or similar code with malicious code and exploits the vulnerabilities based on the website trusting in the user’s requests. This article shows how such an attack can be performed on an unsecure webpage using Burpsuite.

==Step-by-Step Practical CSRF example using Burpsuite==

Required Software:
* [https://portswigger.net/burp/communitydownload Burp Suite]
* [https://sourceforge.net/projects/owaspbwa/ﬁles/ OWASP Broken Web Application Project]

Be careful to only start the OWASP Broken Web Application Project using VMNets with "host only" or "NAT" networks due to security reasons, as this application has intentionally a lot of vulnerabilities to explore.
Steps:
* Start Burp Suite and select "Temporary project"
BILD
* To conﬁgure the browser (in this case Firefox) to work with Burp Suite one has follow the steps below:
• Menu - Preferences - Options - General - Network Proxy - Settings.
• Select "Manual proxy conﬁguration"
• Fill out the "HTTP Proxy" ﬁeld with the Burp Proxy Listener address chosen when starting Burp Suite.(default(127.0.0.1))
• Fill out the "Port" ﬁeld with the Burp Proxy Listener port also chosen before.(default(8080))
• Check the "Use this proxy server for all protocols" box
• Delete if necessary any information in the "No proxy for" ﬁeld and click "OK"[14]
BILD
* To be able to open https-Websites while running Burp Suite, one has to install Burp’s CA Certiﬁcate. The steps of how to do that using Firefox can be seen in the following part of this article:
• Enter "http://burp" in your browser and click on the "CA Certiﬁcate" Button in the uppermost right corner of the browser to download the certificate
• Remember the download location
• Menu - Preferences - Options - Privacy and Security - Certiﬁcates - View Certiﬁcates - Authorities - Import
• Select the Burp CA certiﬁcate ﬁle, that you just downloaded and click "Open"
• Check the box "Trust this CA to identify web sites" when the dialog box pops up and save it by clicking on "OK"
• after restarting Firefox it should be possible to open https-Websites while running Burp Suite[16]
After this initial setup, one has to ensure that in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" is chosen.

To test the “GETBOO” website of the OWASP Broken Web Application Project for CSRF vulnerabilities one then has to follow the steps below:
• Start the VM Ware containing the OWASP Broken Web Application Project and log in using the credentials provided.
BILD
• Open the Website using the address provided in the VM Ware
• Choose GetBoo
• Authenticate into the website with the credentials user:user
BILD
• Modify in the tab "Settings - - Modify account information" the value of the ﬁeld "Email"

BILDER

• Chose in Burp Suite in the "Intercept" tab of the "Proxy" tab "Intercept is on".

• Submit the request so Burp Suite is able to capture the data

• In the "Proxy" tab right click on the raw request - Engagement tools - Generate CSRF PoC

• In the "CSRF PoC generator" it can be seen that the value of email is changed to "user4@owaspbwa.org"
• Click "Copy HTML" in the same window
• Copy this HTML into a text editor and save it as a HTML ﬁle
• select in the "Intercept" tab of the "Proxy" tab in Burp Suite "Intercept is oﬀ" again
• Open the HTML ﬁle saved before using the same browser as before
If the data is successfully changed, the attack has been successful and the website is vulnerable to CSRF Attacks.[12]

==Conclusion==
Although CSRF is a rather common web application vulnerability, it is not as widely known, as one would think. Therefore, this article offered a step-by-step guide on how to ﬁnd a CSRF vulnerability using Burp Suite. For anyone interested in CSRF the paper [my paper] offers insight into the vulnerabilities of CSRF, the different attack modes and some defensive techniques are explained as well. As CSRF is not the only common web application vulnerability not so widely known, the paper mentioned before also contains an overview of Cross-Site Scripting (XSS) and its attack modes as well as some defensive techniques.

[12] https://support.portswigger.net/customer/portal/articles/ 1965674-using-burp-to-test-for-cross-site-request-forgery-csrf-
[13] https://support.portswigger.net/customer/portal/articles/ 1783055-Installing ConﬁguringyourBrowser.html
[14] https://support.portswigger.net/customer/portal/articles/ 1783066-Installing ConﬁguringyourBrowser-FF.html
[15] https://support.portswigger.net/customer/portal/articles/ 1783075-Installing InstallingCACertiﬁcate.html
[16] https://support.portswigger.net/customer/portal/articles/ 1783087-Installing InstallingCACertiﬁcate-FF.htm

Practical CSRF example using Burp Suite

2020-01-31T13:43:42Z

Nmuehlberger:

User:Nmuehlberger

2020-01-31T13:43:03Z

Nmuehlberger: Nmuehlberger moved page User:Nmuehlberger to Practical CSRF example using Burp Suite: Title change

#REDIRECT [[Practical CSRF example using Burp Suite]]

Practical CSRF example using Burp Suite

2020-01-31T13:43:03Z

Nmuehlberger: Nmuehlberger moved page User:Nmuehlberger to Practical CSRF example using Burp Suite: Title change

Practical CSRF example using Burp Suite

2020-01-31T13:40:25Z

Nmuehlberger: Blanked the page

Practical CSRF example using Burp Suite

2020-01-31T13:37:08Z

Nmuehlberger: Created page with "== Introdutcion == As the internet is used nowadays for ﬁelds like e-commerce, ﬁnance and healthcare, web applications need to become more and more secure to prevent atta..."

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T20:39:30Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
[[File:AES132ADatasheet.pdf]] -> that Datasheet is made available from Atmel to get a better understanding of the ATAES132A Chip.

The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefore Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave. Some other problems are, that the example codes for the SAMD21 Xplained Pro board rely too much on that board, so it is nearly impossible to change it for the SAMR21 Xplained Pro B board. Another problem is that Atmel don't even offer an example code to connect to the extension boards, so I wasn't able to check if the ATAES132A chip is working, because no connection could be build. One of the codes is probably working if the connection could be established, because I got a build access and I could load the code onto the board, but I only got negative replies over the Usart.

Here is the link to the projects I tried: [https://github.com/georgie047/Wahlfachprojekt/tree/master/Code/ATAES132A]

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]
those User Guides are made available from Atmel to get a better understanding of their products.

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T20:11:41Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
[[File:AES132ADatasheet.pdf]] -> that Datasheet is made available from Atmel to get a better understanding of the ATAES132A Chip.

The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefore Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave. Some other problems are, that the example codes for the SAMD21 Xplained Pro board rely too much on that board, so it is nearly impossible to change it for the SAMR21 Xplained Pro B board. Another problem is that Atmel don't even offer an example code to connect to the extension boards, so I wasn't able to check if the ATAES132A chip is working, because no connection could be build. One of the codes is probably working if the connection could be established, because I got a build access and I could load the code onto the board, but I only got negative replies over the Usart.

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]
those User Guides are made available from Atmel to get a better understanding of their products.

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:56:22Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
[[File:AES132ADatasheet.pdf]] -> that Datasheet is made available from Atmel to get a better understanding of the ATAES132A Chip.

The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefor Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave.

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]
those User Guides are made available from Atmel to get a better understanding of their products.

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:55:52Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
[[File:AES132ADatasheet.pdf]] -> that Datasheet is made available from Atmel to get a better understanding of the ATAES132A Chip.
The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefor Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave.

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]
those User Guides are made available from Atmel to get a better understanding of their products.

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:49:23Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefor Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave.

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]
those User Guides are made available from Atmel to get a better understanding of their products.

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:41:29Z

Nmuehlberger:

== Summary ==

This documentation describes the usage of security features for microcontrollers especially for the Atmel Sam R21 with the expansion board Atcryptoauth Xpro B.

== Requirements ==
* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Description ==
The Cryptoauth expansion board contains four chips which gets connected via I2C
Chips:
* [https://www.microchip.com/wwwproducts/en/atsha204a ATSHA204A] (SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc508a ATECC508A] (Ellipticcurve P256, SHA256)
* [https://www.microchip.com/wwwproducts/en/atecc608a ATECC608A] (Ellipticcurve P256, SHA256, AES-GCM)
* [https://www.microchip.com/wwwproducts/en/ataes132a ATAES132A] (AES128)

=== Implementation for ATECCx08A and ATSHA204A ===
The [https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b implementation for ATECCx08A and ATSHA204A] is based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib].For ease of use of the ASF USART a custom abstraction layer got implemented.

The example program Implements:
* Showing the serial numbers of the chips
* Hashing a message
* Showing locked zones
* Locking zones
* Generate a random number (only works with locked configuration Zone)
* Generate a keypair (only works with locked configuration Zone)

Usage:
* Connect your microcontroller to the EDGB USB port and upload the software
* Open a terminal Program ([https://www.putty.org/ Putty], [https://ttssh2.osdn.jp/index.html.en TeraTerm])
* Terminal program configuration:
Baud rate 115200
Data bits 8
Stop bits 1
Parity none
* Press the restart button in the controller
* The implementation has an text menu which allows you to navigate by numbers

=== Implementation for ATAES132A ===
The ATAES132A Chip is NOT based on the [https://github.com/MicrochipTech/cryptoauthlib Cryptoauthlib]. Therefor Atmel doesn't offer complete or functioning example codes for this Chip. There are some example codes that might be working but only for the SAMD21 Xplained Pro board not the SAMR21 Xplained Pro B board, which we are using. I tried to use those example codes, with some changes so it would be working with our board, but I got ERROR messages each time. The main error probably is, that the SAMR21 Xplained Pro Microcontroller is not able to connect to the ATAES132A chip as a I2C slave.

== Security Features ==
[[File:Sicherheits-Features.pdf]]

== Cryptographic algorithms ==
[https://git.fh-campuswien.ac.at/c1710475053/atmel-sam-cryptography-with-cryptoauth-xpro-b/blob/master/Dokumentation/Cryptographic_Algorithms.pdf Click here for Pdf]

== User Guides ==
* [[File:User Guide Atmel.pdf]]
* [[File:User Guide EDGB.pdf]]
* [[File:User Guide Security Features.pdf]]

== Used Hardware ==

* [https://www.microchip.com/mplab/avr-support/atmel-studio-7 AtmelStudio]
* [https://www.microchip.com/developmenttools/ProductDetails/atsamr21-xpro Atmel SAM R21 Xplained Pro]
* [https://www.microchip.com/DevelopmentTools/ProductDetails/atcryptoauth-xpro-b ATCRYPTOAUTH-XPRO-B]

== Courses ==
Wahlfachprojekt1 2019

== References ==

Implementation:
* https://www.insidegadgets.com/2017/04/21/alarm-system-v3-part-3-using-the-atmel-cryptoauthentication-atsha204a/
* https://www.youtube.com/watch?v=TAOVKcN-pwY
* https://microchiptech.github.io/cryptoauthlib/html/index.html

Cryptographic algorithms:
* https://en.wikipedia.org/wiki/SHA-2
* http://www.iwar.org.uk/comsec/resources/cipher/sha256-384-512.pdf
* https://www.geeksforgeeks.org/implementation-diffie-hellman-algorithm/
* https://www.korelstar.de/informatik/aes.html
* https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_ciphers

[[Category:Documentation]]

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:29:14Z

Nmuehlberger:

Atmel Sam Cryptography with CryptoAuth-Xpro-B

2019-06-23T11:26:43Z

Nmuehlberger:

File:User Guide Security Features.pdf

2019-06-23T11:22:54Z

Nmuehlberger:

File:User Guide EDBG.pdf

2019-06-23T11:22:40Z

Nmuehlberger:

File:User Guide Atmel.pdf

2019-06-23T11:22:23Z

Nmuehlberger: