I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
I would probably take the following steps:
- Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to
http://mysite.com/account/delwill delete the account you are logged in as
- Next create a basic HTML page that is totally separate from the site you are testing. On this HTML page include the following
<img src="http://mysite.com/account/del" width="0" height="0">
- Next create a dummy account on the site you want to test, and log into that account.
- With the session still active open the basic HTML page you created in the same browser.
- If the account gets deleted, you have a CSRF vulnerability
This is a deliberately simple example, but it should give you the idea of how you can test for CSRF.
You can find resources on preventing CSRF attacks here. Good luck!