0

I am trying to run CSRFTester tool from OWASP to check for CSRF Attack on my web application. I am able to generate an HTML report from the tool but I dont know how to use it..I tried googling it but to no avail. Here are the steps I am following till now:-

> 1. Login to my Web Application.
> 2.Access to the business logic function page.
> 3.Start Recording(CSRFTester)
> 4.Enter the data in form and click on submit.
> 5.CSRFTester tool will store all the information related to this request.
> 6.I modified the value of two parameter from 10,20 to 150,300.
> 7. Generated the Form HTML report and saved it on my desktop.
> 8. Opened a new browser.Logged into my web application with different user.
> 9.Navigate to the business logic function page.

From here On I don't know what exactly I have to do to test for CSRF and how to do it.. Please Guide me..Material available over the net for using this tool have repeatedly stated the same thing which I am not able to understand.

The sites quote :-

Once you generate report open a new browser instance, authenticate as another user with access to the same business function(s) of your testing site, and have then launch the newly created HTML report file. If the action effect after viewing the file in the same browser window that was used to authenticate the the victim, then that particular function is vulnerable to CSRF(cross-site request forgery).

Please guide me..Also if anyone knows about any Free tool to test for CSRF vulnerabilities then please let me know..I tried using Acunetix but to no avail..

AngelsandDemons
  • 2,823
  • 13
  • 47
  • 70

1 Answers1

0

first of all please be sure you understand how CSRF works but if you are using the tool and you are concern about this problem you already knows it.

The report should be a HTML page with some JavaScript code that generates the same requests that you execute when the app was running so:

  1. Run the app and perform some actions in the web application
  2. Open a new session with a new user
  3. Open in the same browser the file CSRFTester just generated
  4. See if the changes you made in the other profile are done too in the actual profile.

If you are not seeing any changes be sure that the actions you perform in the web app are common actions between users, as changing user details.

Pedro Laguna
  • 465
  • 2
  • 5
  • 20
  • I did what you told exactly. Problem is the link which I generated for CSRF Attack when clicked show me the session expired page of my Web Application.When a victim logs in, and clicks on that link I am getting Session Expired Page and the value is also not getting submitted in DB(i.e. the call is not made). – AngelsandDemons Oct 15 '11 at 11:55