Hey there, hackers! What’s good? It’s your pal from IHA089 Labs, back with another crazy challenge to test your skills. If you’ve been chilling with us for a while, you might’ve tried the MailHijackCSRF lab where we played around with some email stuff. That was pretty cool, huh? Now, we’re stepping things up with the ProfilePicCSRF lab. This one’s all about finding a sneaky way to mess with someone’s profile picture. Let me tell you, there’s something fishy going on with the security. I won’t spill the beans just yet—you’ll have to figure that out yourself! So, grab a snack, open your browser, and let’s get ready to break some stuff in a fun way. Here we go!
Table of Contents
Introduction
Imagine you’re scrolling through a social media site, checking out your friends’ posts, when—boom!—your profile picture changes to something totally weird, like a cartoon character or something embarrassing. You didn’t change it, so what happened? That’s the kind of trick we’re diving into today with Cross-Site Request Forgery, or CSRF for short. It’s like a magic trick that attackers use to make your browser do things on a website without you even knowing, as long as you’re logged in.
Here at IHA089 Labs, we love getting hands-on and learning by trying stuff out. The ProfilePicCSRF lab is our latest challenge, and it’s a fun one. You’ll be playing around on a site where you can upload a profile picture. Sounds simple, right? But there’s a catch—there’s a sneaky security problem hiding in there, and your job is to find it and use it to change someone’s picture without their permission. I’m not gonna tell you what the problem is just yet; that’s for you to discover! Let’s just say it’s something that makes this site way less safe than it should be, and you’re gonna have a good time figuring it out.
How CSRF Works Here
CSRF might sound like a big, scary word, but it’s actually pretty simple once you get it. Let me break it down for you in a way that makes sense. When you log into a website—like social media site—your browser gets a special ticket, kind of like a movie ticket. That ticket is called a session cookie, and it tells the website, “Hey, I’m a real user, let me do stuff!” Every time you do something on the site, like uploading a picture or sending a message, your browser sends that ticket along with your request to show it’s really you.
Here’s the tricky part: your browser doesn’t care where the request comes from. Let’s say you visit a shady website while you’re still logged into the social media site. That shady site can send a request to the social media site, and your browser will send the ticket along without even asking you. The social media site sees the ticket, thinks it’s you making the request, and does whatever the request says—like changing your profile picture. That’s what CSRF is all about: tricking your browser into doing stuff on a website without you knowing.
Websites usually try to stop this with a special code called a CSRF token. It’s like a secret password that gets added to every action you do, like uploading a picture. The website checks this code to make sure the action really came from you. But if the website doesn’t do this right, an attacker can find a way to get around it. That’s what’s going on in our lab—there’s a problem with how the site handles these safety checks, and you’re gonna figure out what it is and use it to your advantage. Let’s set the scene so you can start exploring.
Running the ProfilePicCSRF Lab
Setup IHA089 Labs on your system
Ready to test your hacking skills? Here’s how to jump into the ProfilePicCSRF Lab and start messing with some sneaky CSRF exploits:
- Fire Up IHA089 Labs: Run the IHA089 Labs and head to the CSRF category to find the good stuff.
- Pick the Lab: From the list of labs, spot ProfilePicCSRF Lab and type its number to select it. Easy peasy.
- Grab the URL: The lab will spit out a URL (something like https://iha089-labs.in). Pop that into your browser to get to the lab’s web app.
Your Mission, Should You Choose to Accept It
Alright, it’s time to get sneaky! Your mission is to find the weak spot in this vulnerable site and use it to change someone’s profile picture without them knowing. Here’s what you need to do, step by step:
- First, you’ll need two users for this challenge. Register two accounts on the site using emails that end with @iha089.org. For example, make one user
target@iha089.org—this will be your victim—and another userattacker@iha089.org—this will be you, the sneaky hacker. Log into both accounts, but use different browsers for each. Maybe use Chrome for the target and Firefox for the attacker, so you don’t mix them up. - Now, as the attacker, go to the /profile page in your browser (the one where you’re logged in as
attacker@iha089.org). Look at the form that lets you upload a picture. What does it do? Where does it send the picture? What’s in the form that’s supposed to keep things safe? Take a close look—you’re trying to find something that doesn’t look right. - Next, make your own tricky webpage—maybe call it tricky-pic.html or something clever. Create a form that looks a lot like the one on /profile, but sends the request to https://iha089-labs.in/update-profile-pic. Add a picture you want to upload, like sneaky-pic.jpg. You’ll need to make sure your form has all the same pieces as the real one, including that hidden safety part.
- Here’s the big part: you need to get the victim to visit your tricky page while they’re logged into the site. In a real attack, you might send them a link in an email or hide the form on another website. For this lab, you can start a Python local server where tricky-pic.html is saved. Just run a command like python -m http.server 8000 in the folder where your file is, then open the URL—like http://localhost:8000/tricky-pic.html—in the browser where you’re logged in as the victim (target@iha089.org). Then browse to that tricky page.
- Finally, see if your trick worked. Go back to /profile in the browser where you’re logged in as the target (target@iha089.org)—does the profile picture show your sneaky image? If it does, you found the weak spot and used it like a pro!
Wrapping It Up
After finishing the ProfilePicCSRF lab at IHA089 Labs, you found a weak spot in the site’s safety and used it to change someone’s profile picture like a sneaky pro. This challenge showed you how little mistakes in a website can let attackers do things they shouldn’t, and you got to play the bad guy for a bit to see how it works.
Now that you know how to spot these weak spots, you can also learn how to fix them. In a real website, you’d want to make sure every user has their own special safety code that changes all the time, so attackers can’t guess it. You could also add extra checks to make sure requests are coming from the right place. That’s how you keep a site safe, and now you know what to look for. Keep hacking the right way and stay curious!
Disclaimer: This is just for learning, okay? Don’t use these tricks on real websites—that’s not okay. Always hack the right way and follow the rules.