9

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?

18

I would probably take the following steps:

  1. Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to http://mysite.com/account/del will delete the account you are logged in as
  2. Next create a basic HTML page that is totally separate from the site you are testing. On this HTML page include the following <img src="http://mysite.com/account/del" width="0" height="0">
  3. Next create a dummy account on the site you want to test, and log into that account.
  4. With the session still active open the basic HTML page you created in the same browser.
  5. If the account gets deleted, you have a CSRF vulnerability

This is a deliberately simple example, but it should give you the idea of how you can test for CSRF.

You can find resources on preventing CSRF attacks here. Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.