9

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?

2 Answers 2

19

I would probably take the following steps:

  1. Identify a URL on your site where a CSRF attack could have a negative effect on your site. For this example lets say a GET request to http://mysite.com/account/del will delete the account you are logged in as
  2. Next create a basic HTML page that is totally separate from the site you are testing. On this HTML page include the following <img src="http://mysite.com/account/del" width="0" height="0">
  3. Next create a dummy account on the site you want to test, and log into that account.
  4. With the session still active open the basic HTML page you created in the same browser.
  5. If the account gets deleted, you have a CSRF vulnerability

This is a deliberately simple example, but it should give you the idea of how you can test for CSRF.

You can find resources on preventing CSRF attacks here. Good luck!

2
-2

Make a simple Python app, that goes to, for our purposes, http://www.example.com/logout, and import the requests module (code below) and then run it. If you get logged out, you have a CSRF vulnerability.

Python 3.x.x:

import requests as r
r.get("http://www.example.com/logout")
1
  • 2
    There needs to be a little more than just an arbitrary request to a logout function. If an arbitrary system can issue a request to this function and some other client gets logged out, you have far more than a CSRF problem.
    – schroeder
    Feb 5 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.