0

I am trying to run CSRFTester tool from OWASP to check for CSRF Attack on my web application. I am able to generate an HTML report from the tool but I dont know how to use it..I tried googling it but to no avail. Here are the steps I am following till now:-

> 1. Login to my Web Application.
> 2.Access to the business logic function page.
> 3.Start Recording(CSRFTester)
> 4.Enter the data in form and click on submit.
> 5.CSRFTester tool will store all the information related to this request.
> 6.I modified the value of two parameter from 10,20 to 150,300.
> 7. Generated the Form HTML report and saved it on my desktop.
> 8. Opened a new browser.Logged into my web application with different user.
> 9.Navigate to the business logic function page.

From here On I don't know what exactly I have to do to test for CSRF and how to do it.. Please Guide me..Material available over the net for using this tool have repeatedly stated the same thing which I am not able to understand.

The sites quote :-

Once you generate report open a new browser instance, authenticate as another user with access to the same business function(s) of your testing site, and have then launch the newly created HTML report file. If the action effect after viewing the file in the same browser window that was used to authenticate the the victim, then that particular function is vulnerable to CSRF(cross-site request forgery).

Please guide me..Also if anyone knows about any Free tool to test for CSRF vulnerabilities then please let me know..I tried using Acunetix but to no avail..

4

1 回答 1

0

首先，请确保您了解 CSRF 的工作原理，但如果您正在使用该工具并且担心这个问题，那么您已经知道了。

该报告应该是一个 HTML 页面，其中包含一些 JavaScript 代码，这些代码生成的请求与您在应用程序运行时执行的请求相同，因此：

  1. 运行应用程序并在 Web 应用程序中执行一些操作
  2. 与新用户打开新会话
  3. 在同一浏览器中打开刚刚生成的文件 CSRFTester
  4. 查看您在其他配置文件中所做的更改是否也在实际配置文件中完成。

如果您没有看到任何更改，请确保您在 Web 应用程序中执行的操作是用户之间的常见操作，如更改用户详细信息。

于 2011-10-13T16:37:40.390 回答