This methodology of knowing if a person is meant to become rich is not a theory, it is actually practiced and applied on horoscopes to predict about a person's life and to figure out if a person is meant to become really successful and will become rich in his life. In a horoscope, there are 12 houses and 9 planets (excluding Uranus, Neptune and Pluto). Most astrologers see 1st, 2nd, 5th, 6th, 9th, 10th and 11th house, and their lords to see if a person has the capability to become rich and successful. Some also take the benefic aspects from Jupiter, Venus, Mercury and Moon into account.The actual answer does not come through this way. To accurately know if a person is meant to become rich and successful you need to see these three things: The Person's Intelligence Benevolence of The Planets Support from The Time When these three things combine then a person actually becomes successful. I am sure that you find this very logical.
Cross Site Request Forgery (CSRF)
Definition: Cross-Site Request Forgery (CSRF) is a type of attack that
occurs when a malicious Web site, email, blog, instant message, or program
causes a user's Web browser to perform an unwanted action on a trusted site for
which the user is currently authenticated.
For example, this attack could result in a transfer of funds,
changing a password, or purchasing an item in the user's context.
Session Id: Long string, randomly generated to identify a logged in
user. Session ids are locked with the IP address of system for which it was
generated (same session id cannot be used on 2 different systems; this is a
simple way through which Session Ids make connections secure). Typically short
lived and expires as soon as user logs out or shuts the system down.
Token Id: Cryptographically secured large random string, generated
once for each session.
Example: When a user logs in to a website, Server issues a
unique Token id (say, ‘abcd1234’). This token id is stored as a hidden field in
the requested html form. Every time user makes a query, the Token id stored in
the form is used to identify the user.
NOTE: Similarity between Token Id and Session Id,
1.
Randomly generated long strings.
2.
Generated when a user logs in.
3.
Remains as long as session continues (or, user is
logged in).
 |
| Fig: Cross Site Request Forgery (CSRF) |
CSRF Attack and
Prevention
When a user logs in to a website, a session is created and a
token id is generated for that session and stored on the server side (Static
Analysis). Form (web page) requested by the user contains that token id as a
hidden field. When user makes a query, the form is sent along with the token id
present in it, which does the user verification (Dynamic Analysis).
During a CSRF attack, attacker sends the form/query through
the user system. Since the form sent by the attacker does not contain the token
id, therefore verification is failed during dynamic analysis and attack is
identified.
An attacker
can never modify data coming through the server; it can only have access and
send data from the client site.
This diagram
shows that a malicious site is using user/client/victim’s cookies in order to
submit a form and make the CSRF attack happen.
But the
token id is stored in encrypted form in the cookies, which cannot be read or
modified by the attacker. Hence no form submission can be forced and server is
prevented from attack.
Other type of web attack are XSS & SQL Injection.
 |
| CSRF Attack & Prevention Sequence Diagram |
Other type of web attack are XSS & SQL Injection.
Comments
Post a Comment