Search the Community

XSRF Probe XSRF Probe is an advanced Cross Site Request Forgery Audit Toolkit equipped with Powerful Crawling and Intelligent Token Generation Capabilities. Some Features: Performs several types of checks before declaring an endpoint as vulnerable. Can detect several types of Anti-CSRF tokens in POST requests. Works with a powerful crawler which features continuous crawling and scanning. Out of the box support for custom cookie values and generic headers. Accurate Token-Strength Detection and Analysis using various algorithms. Can generate both normal as well as maliciously exploitable CSRF proof of concepts. Well documented code and highly generalised automated workflow. The user is in control of everything whatever the scanner does. Has a user-friendly interaction environment with full verbose support. Detailed logging system of errors, vulnerabilities, tokens and other stuffs. The Workflow: The typical workflow of this scanner is :- Spiders the target website to find all pages. Finds all types of forms present on the each page. Hunts out hidden as well as visible parameter values. Submits each form with normal tokens & parameter values. Generates random token strings and sets parameter values. Submits each form with the crafted tokens. Finds out if the tokens are sufficiently protected. Generates custom proof of concepts after each successful bug hunt. Changelog v2.1 Some significant changes in this version: XSRFProbe now available as a package (aka can be installed via pip). Added full support of cookies while making requests. Fixed form-type bugs and added email type checks. Tweaked some modules for accuracy in CSRF detections. Major bug fixes removing support for build_opener libraries. Huge code optimizations (cleaning and stuff). [HIDE][Hidden Content]]

The Prime Cross Site Request Forgery Audit and Exploitation Toolkit XSRFProbe is an advanced Cross Site Request Forgery (CSRF/XSRF) Audit and Exploitation Toolkit. Equipped with a Powerful Crawling Engine and Numerous Systematic Checks, it is now able to detect most cases of CSRF vulnerabilities, their related bypasses and futher generate (maliciously) exploitable proof of concepts with each found vulnerability. Some Features: Performs several types of checks before declaring an endpoint as vulnerable. Can detect several types of Anti-CSRF tokens in POST requests. Features a powerful crawler which features continuous crawling and scanning. Out of the box support for custom cookie values and generic headers. Accurate Token-Strength Detection and Analysis using various algorithms. Can generate both normal as well as maliciously exploitable CSRF PoCs. Follows a redirect when there is a 30x response. Well documented code and highly generalised automated workflow. The user is in control of everything whatever the scanner does. Has a user-friendly interaction environment with full verbose support. Detailed logging system of errors, vulnerabilities, tokens and other stuffs. Gallery: Lets see some real-world scenarios of XSRFProbe in action: Version and License: XSRFProbe v2.0 release is now a stable release and the work is licensed under the GPL v3 License. Source & Download [hide][Hidden Content]]