From c7da546249ce95f2f53374fc4d6979ead674deb1 Mon Sep 17 00:00:00 2001 From: Matthias Grundmann Date: Thu, 14 Jun 2018 11:00:43 +0200 Subject: [PATCH] Improve text for lesson about CSRF login --- .../src/main/resources/lessonPlans/en/CSRF_Login.adoc | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Login.adoc b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Login.adoc index ea480f4959..dfc8ec8540 100644 --- a/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Login.adoc +++ b/webgoat-lessons/csrf/src/main/resources/lessonPlans/en/CSRF_Login.adoc @@ -16,9 +16,11 @@ the activities of the user. image::images/login-csrf.png[caption="Figure: ", title="Login CSRF from Robust Defenses for Cross-Site Request Forgery", width="800", height="500", style="lesson-image" link="http://seclab.stanford.edu/websec/csrf/csrf.pdf"] {blank} -For more information read the following http://seclab.stanford.edu/websec/csrf/csrf.pdf[paper] +For more information read the following http://seclab.stanford.edu/websec/csrf/csrf.pdf[paper]. -In this assignment try to see if WebGoat is also vulnerable for a login CSRF attack. First create a user -based on your own username prefixed with csrf. So if your username is `tom` you must create -a new user called `csrf-tom` +In this assignment try to see if WebGoat is also vulnerable for a login CSRF attack. +Leave this tab open and in another tab create a user based on your own username prefixed with `csrf-`. +So if your username is `tom` you must create a new user called `csrf-tom`. +Login as the new user. This is what an attacker would do using CSRF. Then click the button in the original tab. +Because you are logged in as a different user, the attacker learns that you clicked the button.