Research on developing a lab environment for cross site request forgery: Attack and defense education in higher vocational colleges

Abstract

Cross Site Request Forgery (CSRF) is among the most exploited web security vulnerabilities. Yet it has received comparatively less attention. It's a must for web site administrators to protect their web sites from CSRF attacks. In order to let the students master the attack and defense skills of CSRF, it's essential to let them have the opportunity to truly practice the attacks as hackers do, and to practice the defenses as web site administrators do. Yet we haven't seen much research done in the area of developing lab environments to facilitate CSRF education in higher vocational colleges. In this paper, we have shown how teachers in higher vocational colleges can develop a simple lab environment for CSRF attack and defense education. We believe that the developed lab environment will facilitate the education of CSRF attack and defense. And we suggest that a lot more researches need to be done in the area of developments of attack and defense lab environments to improve the outcomes of network security education in higher vocational colleges.

An Introduction to Remote Installation Vulnerability in Content Management Systems

“…Some researchers have analyzed so-called brute force attacks and methods of retrofitting against them (Cho et al, 2011;Cho et al, 2012;Rashwan et al, 2011;Laccetti & Schmid, 2007). Numerous studies have also focused on vulnerabilities that have given rise to DNS hijacking attacks (Brahmasani & Sivasankar, 2013;Shulman & Waidner, 2014), cross site request forgery (Siddiqui & Verma, 2011;Jovanovic, Kirda & Kruegel, 2006;Shahriar & Zulkernine, 2010;Zeng, 2013;Feil & Nyffenegger, 2008), misconfiguration (Saeed & Elgabar, 2014;Steinke, Tundreab & Kellya, 2011), content spoofing (Jitpukdebodin, Chokngamwong & Kungpisdan, 2014;Chavan & Meshram, 2013), local file inclusion (Ami & Malav, 2013), phishing attacks (Dadkhah, Lyashenko & Jazi, 2015;Nyeste & Mayhorn, 2012), and remote file inclusion (Robledo, 2008;Srivastava, 2012). However, there are no studies on the vulnerability of remote installation on what we will term remote installation vulnerability (RIV).…”