2

Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do.

Exclusion lists for such test case:

  1. Burp Suite
  2. CSRFTester

Have had tested with them, get's tedious and inefficient.

1
  • At the end of the day, does it matter if there are multiple hidden fields. Which values are considered secret? Anything unknown to the attacker will mean that a CSRF attack cannot take place, so anything secret will do. Try logging out and logging in and find which values have changed. Also, Burp scanner and Burp Intruder in sniper mode may help break the tedium. May 15, 2015 at 19:10

1 Answer 1

2

Burp Suite's extender has a couple of CSRF plugins which might help improve your experience. They either attempt to spot requests with no CSRF protection token as part of the passive scanner, or perform active checks to see if the requests can be performed (i.e. get a 200 OK response) without the tokens.

You might also be interested in zaproxy, which is an open-source alternative to Burp Suite that has the same features and a few more. It might fit you better. The UI isn't quite as intuitive, but it's still great.

Personally, for doing testing of a large number of pages/sites, I'd write a really simple testing script in Python using Scrapy. For each of the given response objects, access the response body, then use the xpath(query) or css(query) functions to identify forms which have CSRF token fields with a given name. You can then gather the full set of inputs to those fields and the target URL.

Once you've got a series of form targets and fields, you can tweak the CSRF tokens as you please, then attempt to submit the forms with whatever values you see fit. Check the response values to see if the result comes back with an error, or redirects to an error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.