XSRFProbe is an advanced Cross Site Request Forgery (CSRF/XSRF) Audit and Exploitation Toolkit. Equipped with a powerful crawling engine and numerous systematic checks, it is able to detect most cases of CSRF vulnerabilities, their related bypasses and futher generate exploitable proof of concepts with each found vulnerability. For more info on how XSRFProbe works, see XSRFProbe Internals on wiki.
XSRFProbe Wiki •
Getting Started •
General Usage •
Advanced Usage •
XSRFProbe Internals •
Gallery Every check XSRFProbe runs has a unique identifier. The ID is shown in the console output (e.g. Lets see some real-world scenarios of XSRFProbe in action: For the full usage info, please take a look at the wiki's — General Usage and Advanced Usage. XSRFProbe can be easily installed via a single command: XSRFProbe is currently Do not use this tool on a live site! It is because this tool is designed to perform all kinds of form submissions automatically which can sabotage the site. Sometimes you may screw up the database and most probably perform a DoS on the site as well. Test on a disposable/dummy setup/site! Usage of XSRFProbe for testing websites without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. The author assumes no liability and is not responsible for any misuse or damage caused by this program. This project is based entirely upon my own research and my own experience with web applications on Cross-Site Request Forgery attacks. You can try going through the source code to help you understand how this toolkit was built. Useful pull requests, ideas and issues are highly welcome. If you wish to see what how XSRFProbe is being developed, check out the Development Board. Crafted with ♡ by @0xInfection
-blue.svg){kind=icon}
Origin: null) as well as method-override and Content-Type bypasses.--max-urls, --max-depth and --crawl-timeout).[T6] VULNERABLE: ...) and stored as the test_id field of each finding in the JSON report (alongside its severity and, where relevant, an exploitability note under details), so each finding maps back to the exact test that produced it.ID Category Check D1Token presence No anti-CSRF token present (generic request forgery) D2Token presence Login form lacks CSRF token (login CSRF) T2Token tampering Validation tied to request method (GET ↔ POST switch) T3Token tampering Token can be omitted entirely T4Token tampering Token not tied to the user session (cross-session replay) T5Token tampering Token tied to a non-session cookie (e.g. csrfKey)T6Token tampering Naive double-submit cookie (cookie == body, no binding) T7Token tampering Empty token value accepted T8Token tampering Custom-header token can be omitted or forged M1Method / Content-Type HTTP method override via _method parameterM2Method / Content-Type HTTP method override via X-HTTP-Method-Override headerM4Method / Content-Type Validation bypass via alternate Content-TypeR0Referer Referer header not validated on form submission R1Referer Referer validation bypassed by omitting the header R2aReferer Referer regex bypass — target as attacker subdomain R2bReferer Referer regex bypass — target in query string R2cReferer Referer regex bypass — target in path O1Origin Origin validation bypassed with Origin: nullO2Origin Origin validation bypassed with a subdomain trick O3Origin Origin validation bypassed by omitting the header S2SameSite (browser)
SameSite=Strict bypass via client-side redirect gadgetS3SameSite (browser)
SameSite=Strict bypass via XSS on a sibling subdomainS4SameSite (browser)
SameSite=Lax bypass via cookie-refresh / OAuth flowC1Cookie posture Cookie SameSite attribute analysis (None/Lax/Strict)C2Cookie posture No SameSite attribute set on cookiesE1Token strength Token uses a weak/structured hash encoding A1Token strength Post-scan token predictability / forgeability analysis S* checks require the optional headless-browser integration (--browser). T*/M*/R*/O* are HTTP-level checks gated by the response diffing/benchmark engine.
pip install xsrfprobe
pip install .
xsrfprobe --help
--browser, --auto-validate-poc) additionally require geckodriver to be available in your PATH (or pointed to via --geckodriver-path).xsrfprobe-output. Under this folder you can view the detailed logs and information collected during the scans (pass --json for a machine-readable report).v3.0.0 and the work is licensed under the GNU General Public License (GPLv3).
