XSRFProbe

The Prime Cross Site Request Forgery Audit & Exploitation Toolkit.

About

XSRFProbe is an advanced Cross Site Request Forgery (CSRF/XSRF) Audit and Exploitation Toolkit. Equipped with a powerful crawling engine and numerous systematic checks, it is able to detect most cases of CSRF vulnerabilities, their related bypasses and futher generate exploitable proof of concepts with each found vulnerability. For more info on how XSRFProbe works, see XSRFProbe Internals on wiki.

XSRFProbe Wiki • Getting Started • General Usage • Advanced Usage • XSRFProbe Internals • Gallery

Some Features

• Runs a full battery of systematic checks — backed by a response diffing/benchmark engine — before declaring an endpoint vulnerable.
• Detects and actively tampers with many Anti-CSRF token implementations: request-method switch, token removal, empty/duplicated values, non-session-bound tokens, double-submit cookies and custom-header tokens.
• Probes Referer and Origin validation with real-world bypasses (header removal, regex/subdomain tricks, Origin: null) as well as method-override and Content-Type bypasses.
• Analyses SameSite cookie protections, with optional subdomain enumeration (via crt.sh) for sibling-domain bypass testing.
• Works with a powerful crawler featuring deterministic, bounded crawling and scanning (configurable via --max-urls, --max-depth and --crawl-timeout).
• Optional headless Firefox (Selenium) integration for browser-dependent tests and auto-validation of generated PoCs.
• Accurate Token-Strength Detection and Analysis using entropy and encoding checks.
• Can generate both normal as well as maliciously exploitable CSRF proof of concepts.
• Out of the box support for custom cookie values, generic headers and a JSON report — each finding carries a severity rating and an exploitability precondition.
• The user is in control of everything whatever the scanner does.
• User-friendly interaction environment with full verbose support and detailed logging of errors, vulnerabilities and tokens.

Vulnerability Tests Performed:

Every check XSRFProbe runs has a unique identifier. The ID is shown in the console output (e.g. [T6] VULNERABLE: ...) and stored as the test_id field of each finding in the JSON report (alongside its severity and, where relevant, an exploitability note under details), so each finding maps back to the exact test that produced it.

ID	Category	Check
D1	Token presence	No anti-CSRF token present (generic request forgery)
D2	Token presence	Login form lacks CSRF token (login CSRF)
T2	Token tampering	Validation tied to request method (GET ↔ POST switch)
T3	Token tampering	Token can be omitted entirely
T4	Token tampering	Token not tied to the user session (cross-session replay)
T5	Token tampering	Token tied to a non-session cookie (e.g. csrfKey)
T6	Token tampering	Naive double-submit cookie (cookie == body, no binding)
T7	Token tampering	Empty token value accepted
T8	Token tampering	Custom-header token can be omitted or forged
M1	Method / Content-Type	HTTP method override via _method parameter
M2	Method / Content-Type	HTTP method override via X-HTTP-Method-Override header
M4	Method / Content-Type	Validation bypass via alternate Content-Type
R0	Referer	Referer header not validated on form submission
R1	Referer	Referer validation bypassed by omitting the header
R2a	Referer	Referer regex bypass — target as attacker subdomain
R2b	Referer	Referer regex bypass — target in query string
R2c	Referer	Referer regex bypass — target in path
O1	Origin	Origin validation bypassed with Origin: null
O2	Origin	Origin validation bypassed with a subdomain trick
O3	Origin	Origin validation bypassed by omitting the header
S2	SameSite (browser)	SameSite=Strict bypass via client-side redirect gadget
S3	SameSite (browser)	SameSite=Strict bypass via XSS on a sibling subdomain
S4	SameSite (browser)	SameSite=Lax bypass via cookie-refresh / OAuth flow
C1	Cookie posture	Cookie SameSite attribute analysis (None/Lax/Strict)
C2	Cookie posture	No SameSite attribute set on cookies
E1	Token strength	Token uses a weak/structured hash encoding
A1	Token strength	Post-scan token predictability / forgeability analysis

S* checks require the optional headless-browser integration (--browser). T*/M*/R*/O* are HTTP-level checks gated by the response diffing/benchmark engine.

Gallery

Lets see some real-world scenarios of XSRFProbe in action:

Installation & Usage

For the full usage info, please take a look at the wiki's — General Usage and Advanced Usage.

Installing via Pypi:

XSRFProbe can be easily installed via a single command:

pip install xsrfprobe