E: 31/01 Win A Gillette Goody Bag

Lakshmi7

Rugby World

Answer: 1179 (Please thank posters below. :T :T :T)

Second competition down.

GeeBee38

According to this on the 13/12/2011 he scored 1179, not sure if this is correct tho?
As i know nothing about rugby, sorry

http://www.dailymail.co.uk/news/article-2073271/Jonny-Wilkinson-announces-retirement-international-rugby.html

beepow

i agree with Goblin36 plus its one of the answers! x

worriedmum46

• csrf token: CSRF attack detected.

Not sure what it means,,,,,,,,,,,,,, but just to let you know.Might be a problem

cinders59

worriedmum46 wrote: »

• csrf token: CSRF attack detected.

Not sure what it means,,,,,,,,,,,,,, but just to let you know.Might be a problem

I got exactly the same and my entry didn't go through

pavers

Goblin36 wrote: »

According to this on the 13/12/2011 he scored 1179, not sure if this is correct tho?
As i know nothing about rugby, sorry

http://www.dailymail.co.uk/news/article-2073271/Jonny-Wilkinson-announces-retirement-international-rugby.html

1179

Same answeron wikipedia:D

bbdiva1977

Works fine on chrome

Summit_Plummet

csrf token: CSRF attack detected in IE but fine in FF

ThinkingOfLinking

csrf token: CSRF attack detected in IE and FF.

mclarkie

Cross-site request forgery CSRF

http://en.wikipedia.org/wiki/Cross-site_request_forgery

I'm getting the same message with IE9

I've now tried Safari, and it went through ok

fcshjm

Cross-site request forgery

From Wikipedia, the free encyclopedia

Jump to: navigation, search
Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf[1]) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts.[2] Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.
Contents

URL="http://forums.moneysavingexpert.com/#"][COLOR=#0066cc]hide[/COLOR][/URL

• 1 Background
• 2 Example and characteristics
• 3 Limitations
• 4 Severity
• 5 Forging login requests
• 6 Other approaches to CSRF
• 7 Prevention
• 8 See also
• 9 References
• 10 External links

URL="http://forums.moneysavingexpert.com/w/index.php?title=Cross-site_request_forgery&action=edit&section=1"][COLOR=#0066cc]edit[/COLOR][/URL Background

CSRF vulnerabilities have been known and in some cases exploited since 2001.[3] Because it is carried out from the user's IP address, some website logs might not have evidence of CSRF.[2] Exploits are under-reported, at least publicly, and as of 2007[4] there are few well-documented examples. About 18 million users of eBay's Internet Auction Co. at Auction.co.kr in Korea lost personal information in February 2008I][URL="http://forums.moneysavingexpert.com/wiki/Wikipedia:Citation_needed"][COLOR=#0066cc]citation needed[/COLOR][/URL][/I. Customers of a bank in Mexico were attacked in early 2008 with an image tag in email. The link in the image tag changed the DNS entry for the bank in their ADSL router to point to a malicious website, impersonating the bank.[5]
URL="http://forums.moneysavingexpert.com/w/index.php?title=Cross-site_request_forgery&action=edit&section=2"][COLOR=#0066cc]edit[/COLOR][/URL Example and characteristics


A National Vulnerability Database page describing a CSRF hole


The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated.[1] For example, one user, Bob, might be browsing a chat forum where another user, Fred, has posted a message. Suppose that Fred has crafted an HTML image element that references an action on Bob's bank's website (rather than an image file), e.g.,
<img src="http://bank.example.com/withdraw?account=bob&amount=1000000&for=Fred"&gt;
If Bob's bank keeps his authentication information in a cookie, and if the cookie hasn't expired, then the attempt by Bob's browser to load the image will submit the withdrawal form with his cookie, thus authorizing a transaction without Bob's approval.
A cross-site request forgery is a confused deputy attack against a Web browser. The deputy in the bank example is Bob's Web browser which is confused into misusing Bob's authority at Fred's direction.
The following characteristics are common to CSRF:

• Involve sites that rely on a user's identity
• Exploit the site's trust in that identity
• Trick the user's browser into sending HTTP requests to a target site
• Involve HTTP requests that have side effects

At risk are web applications that perform actions based on input from trusted and authenticated users without requiring the user to authorize the specific action. A user who is authenticated by a cookie saved in the user's web browser could unknowingly send an HTTP request to a site that trusts the user and thereby causes an unwanted action.
CSRF attacks using image tags are often made from Internet forums, where users are allowed to post images but not JavaScript.