I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
2 Answers
I would probably take the following steps:
- Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to
http://mysite.com/account/del
will delete the account you are logged in as - Next create a basic HTML page that is totally separate from the site you are testing. On this HTML page include the following
<img src="http://mysite.com/account/del" width="0" height="0">
- Next create a dummy account on the site you want to test, and log into that account.
- With the session still active open the basic HTML page you created in the same browser.
- If the account gets deleted, you have a CSRF vulnerability
This is a deliberately simple example, but it should give you the idea of how you can test for CSRF.
You can find resources on preventing CSRF attacks here. Good luck!
-
2Rats, you beat me to an answer! Here's a +1 and another link: owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)#How_to_Test Sep 18, 2014 at 6:12
-
1@AnanduMDas if you want to test properly you should read the complete OWASP guide. Sep 23, 2014 at 13:21
Make a simple Python app, that goes to, for our purposes, http://www.example.com/logout, and import the requests module (code below) and then run it. If you get logged out, you have a CSRF vulnerability.
Python 3.x.x:
import requests as r
r.get("http://www.example.com/logout")
-
2There needs to be a little more than just an arbitrary request to a logout function. If an arbitrary system can issue a request to this function and some other client gets logged out, you have far more than a CSRF problem.– schroeder ♦Feb 5 at 9:35