2

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ZAP proxy scanner did not detect that. I am wondering whether I have done the scan correctly, but could not find any place to verify the configuration.

Can someone help me out?

Anti-CSRF Rule enter image description here

Improve this question

1 Answer 1

Reset to default
2

First check that ZAP actually made the POST request. Its always easier to use the desktop rather than daemon mode when debugging these sort of problems. So start ZAP in desktop mode, explore your app in the same way as before and then check that the POST request is in the Sites tree.

If it is not in the Sites tree then ZAP wont attack it. Exploring your app effectively is key to testing it effectively. If its not been found then there are various options available which we cover if thats the case.

Improve this answer
8
  • I am not using daemon mode. I am using desktop mode. however, I found that in this article, zaproxy.org/docs/desktop/addons/active-scan-rules-beta Anti-CSRF token verification will happen only in the UI layer (just check whether each form has csrf token or not) and it is not actually validating whether Anti-CSRF verification happens from the backend. is there a way I can make that happens also?
    – yello_flash
    Nov 11, 2020 at 11:27
  • No, that rules does perform requests to see if the token appears to be used. We have another rule zaproxy.org/docs/desktop/addons/passive-scan-rules/… which is a passive rule and just checks to see if tokens are used.
    – Simon Bennetts
    Nov 12, 2020 at 9:17
  • I attached a screenshot f the active rule I am talking about. I simply captured a post request via proxy and ran above anti csrf token check to see whether it shows any issues with my POST request. unfortunately, I didn't receive any result. however in that post request actually CSRF validation is not enforced from the backend. any idea why this happened? am I doing something wrong? let me add the post request I captured through owasp proxy.
    – yello_flash
    Nov 13, 2020 at 16:29
  • Request -> POST https://<domain>/training/addCourse HTTP/1.1 CSRF parameter sent in the request body -> addCourse[_csrf_token]=XX
    – yello_flash
    Nov 13, 2020 at 16:36
  • Did you proxy the initial GET request which generates the anti CSRF token through ZAP as well? If not then ZAP wont know where it came from.
    – Simon Bennetts
    Nov 16, 2020 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .