CSRF Demo Video

This is a short demo video of how CSRF attack works. I am using google's jarlsberg for this demo - Always get permission before performing any attacks.

The jarlsberg application "Add Snippet" functionality is vulnerable to CSRF. I am using simple img tags to add messages to the application - this is actually mimicking an attack where by an attacker can add messages on behalf of the victim.

I am simulating that the user while logged into the jarlsberg application is tricked into clicking a link(this particular link is a web server running on my local machine). I then demonstrate through a proxy what happens to the traffic - you will note that the initial request is to localhost but when the img tag is read it loads the vulnerable URL, the browser then automatically appends the correct cookies to the request. You can use pinata to generate the CSRF code here - though this instance uses GET method, Pinata is much more useful when generating POST and multipart POST requests.

If you are interested in Pinata you can find it here - http://code.google.com/p/pinata-csrf-tool/