Cross-Site Request Forgeries: Exploitation and Prevention

Cross-Site Request Forgeries: Exploitation and Prevention

Cached

Download Links

by William Zeller , Edward W. Felten

Citations:

BibTeX

@MISC{Zeller_cross-siterequest,
    author = {William Zeller and Edward W. Felten},
    title = {Cross-Site Request Forgeries: Exploitation and Prevention},
    year = {}
}

Bookmark

OpenURL

Abstract

has fixed the vulnerability described below. Also clarified that our server-side CSRF protection recommendations do not prevent the active network attacks described in [17]. The newest version of this paper can be found at

Citations

50	Robust defenses for cross-site request forgery - BARTH, JACKSON, et al. - 2008
22	Preventing cross site request forgery attacks - Jovanovic, Kirda, et al. - 2006
19	Exposing private information by timing web applications - Bortz, Boneh - 2007
12	RequestRodeo: Client side protection against session riding - Johns, Winter - 2006
4	Protecting the intranet against ‘JavaScript malware’ and related attacks - Johns, Winter - 2007
4	Security Corner: Cross-Site Request Forgeries. http://shiflett.org/articles/cross-site-request-forgeries - SHIFLETT
3	Cross Site Reference Forgery: An introduction to a common web application weakness. http://www.isecpartners.com/ documents/XSRF_Paper.pdf - Burns - 2005
1	Security Threat Classification. http:// www.webappsec.org/projects/threat - Web
1	http://www.alexa.com/ site/sales - Sites - 2007
1	The Evolution of Cross Site Scripting Attacks. http://cgisecurity.com/lib/ XSS.pdf - Endler - 2002
1	CSRF, the sleeping giant. http: //jeremiahgrossman.blogspot.com/ 2006/09/csrf-sleeping-giant.html - Grossman - 2006
1	The crossdomain.xml Witch Hunt - Shiflett - 2006
1	The Dangers of Cross-Domain Ajax with Flash. http://shiflett.org/blog/2006/ sep/the-dangers-of-cross-domainajax-with-flash, Sep 2006. A Internet Explorer and CSRF Cookies can be used to track users across multiple websites. For example, suppose an adverti - Shiflett