Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do.
Exclusion lists for such test case:
Have had tested with them, get's tedious and inefficient.
Burp Suite's extender has a couple of CSRF plugins which might help improve your experience. They either attempt to spot requests with no CSRF protection token as part of the passive scanner, or perform active checks to see if the requests can be performed (i.e. get a 200 OK response) without the tokens.
You might also be interested in zaproxy, which is an open-source alternative to Burp Suite that has the same features and a few more. It might fit you better. The UI isn't quite as intuitive, but it's still great.
Personally, for doing testing of a large number of pages/sites, I'd write a really simple testing script in Python using Scrapy. For each of the given response objects, access the response body, then use the xpath(query) or css(query) functions to identify forms which have CSRF token fields with a given name. You can then gather the full set of inputs to those fields and the target URL.
Once you've got a series of form targets and fields, you can tweak the CSRF tokens as you please, then attempt to submit the forms with whatever values you see fit. Check the response values to see if the result comes back with an error, or redirects to an error.
