'MonkeyFist' Launches Dynamic CSRF Web Attacks'MonkeyFist' Launches Dynamic CSRF Web Attacks

Researchers release tool that automates cross-site request forgery attacks

Dark Reading logo in a gray background | Dark Reading

BLACK HAT USA -- LAS VEGAS -- A pair of researchers here yesterday unleashed a tool that automatically executes dangerous cross-site request forgery (CSRF) attacks.

Shawn Moyer and Nathan Hamiel demonstrated how their tool, MonkeyFist, performs what they call "dynamic" CSRF attacks, or attacks on Websites that have put up preventative measures such as tokenization and session IDs. CSRF is when an attacker makes a Web request within the context of the victim's Web session.

The researchers say the emergence of integrated and aggregated content, such as buttons for Twitter or "Digg This," have opened up even more possibilities for these attacks, which take advantage of a pervasive but difficult-to-detect vulnerability in many Websites.

This "session-riding" attack basically lets the bad guy silently ride atop the victim's Web session. "You're [the attacker] already authenticated into a site, and the user's session, header, and cookie is already there," says Moyer, a hacker on the Security Assessments Team at FishNet Security. "You're already there, so what you're doing is getting the user to do something and you're riding on their session."

It lets an attacker steal credentials from a user, by luring the victim to his malicious Website, for example. The researchers demonstrated a CSRF attack using MonkeyFist on the global password function on Newsweek.com during their presentation here at Black Hat.

MonkeyFist is a Python-based Web server tool that listens and automates per-request, dynamic CSRF attacks. In the demo here, MonkeyFist pointed a Newsweek.com "user" to a "bad guy's" site via the publication's password reset process. The user then went to Reddit, the social networking news and digest site. "A hidden POST reset his password and took him to YouTube," where the researchers had set up a phony video, says Hamiel, senior security consultant with Idea Information Security.

"Using MonkeyFist makes it easy to do host-based CSRF," he says. "It lets you get session ID information through cross-referrer leakage."

The researchers say the tool also simplifies the previously onerous task of a POST-based CSRF attack.

To listen to a TechWeb/InformationWeek podcast interview with Moyer and Hamiel, go to this blog link.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with three decades of experience in reporting and editing for various technology and business publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was selected three consecutive times as one of the Top 10 Cybersecurity Journalists in the US, and was named as one of Folio's 2019 Top Women in Media. She has been with Dark Reading since its launch in 2006.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights