I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
asked Sep 18 '14 at 5:19
I would probably take the following steps:
- Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to
http://mysite.com/account/delwill delete the account you are logged in as - Next create a basic HTML page that is totally separate from the site you are testing. On this HTML page include the following
<img src="http://mysite.com/account/del" width="0" height="0"> - Next create a dummy account on the site you want to test, and log into that account.
- With the session still active open the basic HTML page you created in the same browser.
- If the account gets deleted, you have a CSRF vulnerability
This is a deliberately simple example, but it should give you the idea of how you can test for CSRF.
You can find resources on preventing CSRF attacks here. Good luck!
answered Sep 18 '14 at 6:08
-
2Rats, you beat me to an answer! Here's a +1 and another link: owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)#How_to_Test – PlasmaSauna Sep 18 '14 at 6:12
-
1@AnanduMDas if you want to test properly you should read the complete OWASP guide. – Lucas Kauffman Sep 23 '14 at 13:21
