1
00:00:02,340 --> 00:00:03,210
[Autogenerated] Here's the dental

2
00:00:03,210 --> 00:00:06,640
application we're using. In this course.

3
00:00:06,640 --> 00:00:09,370
It's a customer loyalty website for a

4
00:00:09,370 --> 00:00:12,900
coffee shop. Users can enter their loyalty

5
00:00:12,900 --> 00:00:15,610
number and then an overview pay chose

6
00:00:15,610 --> 00:00:17,880
users can also added their favorite type

7
00:00:17,880 --> 00:00:20,580
off coffee in a field with just one in

8
00:00:20,580 --> 00:00:24,900
boot. Noticed the U. R L decided running

9
00:00:24,900 --> 00:00:30,640
on coffee shop dot com on Port 5005. Since

10
00:00:30,640 --> 00:00:33,300
we're doing quite a few experiments on it

11
00:00:33,300 --> 00:00:35,590
in this course, I'm running the site

12
00:00:35,590 --> 00:00:38,170
locally on my machine. If you want to

13
00:00:38,170 --> 00:00:41,270
recreate the demos on yours, please follow

14
00:00:41,270 --> 00:00:43,620
the instructions in to read me that it's

15
00:00:43,620 --> 00:00:47,220
part of the course Download. Here's a

16
00:00:47,220 --> 00:00:50,310
different website win Bitcoin dot com

17
00:00:50,310 --> 00:00:52,890
Running on another port, It promises me

18
00:00:52,890 --> 00:00:55,750
bit going. All I have to do is press the

19
00:00:55,750 --> 00:00:59,170
button. I found this site by clicking on

20
00:00:59,170 --> 00:01:01,200
the link that wasn't an email with a

21
00:01:01,200 --> 00:01:04,820
title. You want Bitcoin. So I just pressed

22
00:01:04,820 --> 00:01:07,840
the button because I like Bitcoin that

23
00:01:07,840 --> 00:01:10,990
thought. I end up at a loyalty website and

24
00:01:10,990 --> 00:01:13,840
my favorite coffee, exchanged by something

25
00:01:13,840 --> 00:01:16,970
said by an attacker without me having to

26
00:01:16,970 --> 00:01:20,080
log in with my loyalty number, and I

27
00:01:20,080 --> 00:01:22,450
checked my Bitcoin wallet, I didn't get

28
00:01:22,450 --> 00:01:25,950
any. Now, how does this attack work? The

29
00:01:25,950 --> 00:01:28,780
loyalty number entered on the first page

30
00:01:28,780 --> 00:01:32,860
is set in a cookie. We can verify that by

31
00:01:32,860 --> 00:01:36,140
opening the F 12 tools of the browser,

32
00:01:36,140 --> 00:01:38,150
when the browser does the initial request

33
00:01:38,150 --> 00:01:40,540
to the server to our A Speedo Net

34
00:01:40,540 --> 00:01:43,710
application and a loyalty numbers entered

35
00:01:43,710 --> 00:01:46,470
the kookiest set on all subsequent

36
00:01:46,470 --> 00:01:49,520
requests to the server. This cookie will

37
00:01:49,520 --> 00:01:52,310
be sent along so that the application

38
00:01:52,310 --> 00:01:55,480
remembers the loyalty number. Here's the

39
00:01:55,480 --> 00:01:58,750
controller. This application is using M V

40
00:01:58,750 --> 00:02:01,760
C, but the concept is the same for

41
00:02:01,760 --> 00:02:04,600
everywhere publication. I've included a

42
00:02:04,600 --> 00:02:07,480
version off this application for both a

43
00:02:07,480 --> 00:02:09,850
Speedo Net for doneness framework and a

44
00:02:09,850 --> 00:02:11,580
speeder ninth Corps in the course

45
00:02:11,580 --> 00:02:14,310
downloads. When the loyalty numbers

46
00:02:14,310 --> 00:02:17,840
entered the cookie is set in the browser

47
00:02:17,840 --> 00:02:20,770
on subsequent requests, the loyalty number

48
00:02:20,770 --> 00:02:23,780
is retrieved from the cookie. For every

49
00:02:23,780 --> 00:02:26,890
action in the controller, the cookie is

50
00:02:26,890 --> 00:02:30,870
assumed to be there. It is retrieved by

51
00:02:30,870 --> 00:02:34,840
calling get loyalty number from cookie

52
00:02:34,840 --> 00:02:37,050
when the cookie isn't present. In that

53
00:02:37,050 --> 00:02:40,330
method, an exception is thrown the coat

54
00:02:40,330 --> 00:02:42,910
that reacts to the posting off the form

55
00:02:42,910 --> 00:02:45,360
that lets users and that their favorite

56
00:02:45,360 --> 00:02:50,220
coffee also relies on that cookie. The

57
00:02:50,220 --> 00:02:52,790
browser has some basic protection against

58
00:02:52,790 --> 00:02:56,210
Gu Keum issues. Cookies that are set in

59
00:02:56,210 --> 00:03:00,240
the browser are sent to the origin. Only

60
00:03:00,240 --> 00:03:02,940
the origin is the website that sets the

61
00:03:02,940 --> 00:03:07,440
cookie in this guy's coffee shop dot com.

62
00:03:07,440 --> 00:03:09,720
When the same browser doesn't request to

63
00:03:09,720 --> 00:03:12,560
another site, there is not the origin. The

64
00:03:12,560 --> 00:03:15,560
cookie isn't sent. The other website, in

65
00:03:15,560 --> 00:03:18,590
this case runs on wind bit going dot com

66
00:03:18,590 --> 00:03:22,570
and just contains an HTML file. It renders

67
00:03:22,570 --> 00:03:25,980
a form with the submit button. That's the

68
00:03:25,980 --> 00:03:29,590
button I pressed to get the Bitcoin. But

69
00:03:29,590 --> 00:03:32,790
look at the U. R L the former post Sue.

70
00:03:32,790 --> 00:03:35,520
It's the U. R L off the loyalty website

71
00:03:35,520 --> 00:03:38,990
that changes the favorite. That means when

72
00:03:38,990 --> 00:03:42,390
the bottom expressed across side request

73
00:03:42,390 --> 00:03:46,710
occurs from one side to the other. The

74
00:03:46,710 --> 00:03:49,740
value of the form the favorite coffee,

75
00:03:49,740 --> 00:03:52,060
isn't visible to the user because the

76
00:03:52,060 --> 00:03:54,750
input is hidden, but the import does have

77
00:03:54,750 --> 00:03:58,700
value. When submit its breast, a post

78
00:03:58,700 --> 00:04:02,090
request occurs to the loyalty site. The

79
00:04:02,090 --> 00:04:04,550
browser has a cookie for that origin, so

80
00:04:04,550 --> 00:04:07,060
it sends that along, and the favorite

81
00:04:07,060 --> 00:04:09,460
coffee exchanged for the loyalty number in

82
00:04:09,460 --> 00:04:12,870
the cookie that is crossed sides request

83
00:04:12,870 --> 00:04:17,870
forgery or CIA's R F. This attack only

84
00:04:17,870 --> 00:04:20,740
works if users of the browser were on the

85
00:04:20,740 --> 00:04:23,250
coffee website before they pressed a bit

86
00:04:23,250 --> 00:04:26,010
going button. But thousands of phishing

87
00:04:26,010 --> 00:04:28,090
emails are easily sent, and if the

88
00:04:28,090 --> 00:04:30,960
attacker gets a hit rate of only 1% or

89
00:04:30,960 --> 00:04:35,840
less, it could already be worthwhile.

90
00:04:35,840 --> 00:04:38,360
Changing coffee favorites isn't very

91
00:04:38,360 --> 00:04:40,260
profitable for the attacker, of course,

92
00:04:40,260 --> 00:04:42,600
and the logging Magan is, um we used here

93
00:04:42,600 --> 00:04:45,410
is simplified, just asking for the loyalty

94
00:04:45,410 --> 00:04:48,700
number. The cookie with a loyalty number

95
00:04:48,700 --> 00:04:51,620
is, however, like an identity cookie, a

96
00:04:51,620 --> 00:04:54,640
cookie that is set by a weapon application

97
00:04:54,640 --> 00:04:57,520
where users have logged in. The site knows

98
00:04:57,520 --> 00:05:00,080
the identity of the user on each request

99
00:05:00,080 --> 00:05:02,040
that occurs after Logan. Because of this

100
00:05:02,040 --> 00:05:05,540
cookie, imagine what could happen if

101
00:05:05,540 --> 00:05:08,250
innocent users log into the bank.

102
00:05:08,250 --> 00:05:10,060
Afterwards. They go to a side of the

103
00:05:10,060 --> 00:05:12,360
attacker where for Miss posted the

104
00:05:12,360 --> 00:05:15,830
transfers money to the attacker. Let's

105
00:05:15,830 --> 00:05:18,180
take a look at the identity cookie in a

106
00:05:18,180 --> 00:05:25,000
Speedo net. Next you learn a solution for CSR F right away

