Packages and Binaries:

xsrfprobe

Prime Cross Site Request Forgery Audit and Exploitation Toolkit
XSRFProbe is an advanced Cross Site Request Forgery (CSRF/XSRF) Audit and Exploitation Toolkit. Equipped with a powerful crawling engine and numerous systematic checks, it is able to detect most cases of CSRF vulnerabilities, their related bypasses and further generate (maliciously) exploitable proof of concepts with each found vulnerability.

Installed size: 271 KB
How to install: sudo apt install xsrfprobe

xsrfprobe

root@kali:~# xsrfprobe -h

                        ________                    ______
    ____  __________________  __/_______________________  /______
    __  |/_/_  ___/_  ___/_  /_ ___  __ \_  ___/  __ \_  __ \  _ \
    __>  < _(__  )_  /   _  __/ __  /_/ /  /   / /_/ /  /_/ /  __/
    /_/|_| /____/ /_/    /_/    _  .___//_/    \____//_.___/\___/
                                /_/

                                    ~  0xInfection | v3.0.0


usage: xsrfprobe -u <url> <args>

Required Arguments:
  -u, --url URL         Main URL to test

Optional Arguments:
  -c, --cookie COOKIE   Cookie value to be requested with each successive
                        request. If there are multiple cookies, separate them
                        with commas. For example: `-c PHPSESSID=i837c5n83u4,
                        _gid=jdhfbuysf`.
  -o, --output OUTPUT   Output directory where files to be stored. Default is
                        the output/ folder where all files generated will be
                        stored.
  -d, --delay DELAY     Time delay between requests in seconds. Default is
                        zero.
  -q, --quiet           Set the DEBUG mode to quiet. Report only when
                        vulnerabilities are found. Minimal output will be
                        printed on screen.
  -H, --headers HEADERS
                        Comma separated list of custom headers you'd want to
                        use. For example: ``--headers "Accept=text/php,
                        X-Requested-With=XHR"``.
  -v, --verbose         Increase the verbosity of the output (e.g., -vv is
                        more than -v).
  -t, --timeout TIMEOUT
                        HTTP request timeout value in seconds. The entered
                        value may be either in floating point decimal or an
                        integer. Example: ``--timeout 10.0``
  -E, --exclude EXCLUDE
                        Comma-separated paths / file containing paths
                        (separated by newlines) to exclude when crawling and
                        scanning.
  --user-agent USER_AGENT
                        Custom user-agent to be used. Only one user-agent can
                        be specified.
  --max-chars MAXCHARS  Maximum allowed character length for the custom token
                        value to be generated. For example: `--max-chars 5`.
                        Default value is 6.
  --crawl               Crawl the whole site and simultaneously test all
                        discovered endpoints for CSRF.
  --max-urls MAX_URLS   Maximum number of URLs to crawl (with --crawl). 0
                        means unlimited. Default: 200.
  --max-depth MAX_DEPTH
                        Maximum link depth to crawl from the seed URL (with
                        --crawl). 0 means unlimited. Default: 5.
  --crawl-timeout CRAWL_TIMEOUT
                        Wall-clock time budget for crawling in seconds (with
                        --crawl). 0 means unlimited. Default: 0.
  --no-analysis         Skip the Post-Scan Analysis of Tokens which were
                        gathered during requests
  --skip-poc            Skip the PoC Form Generation of POST-Based Cross Site
                        Request Forgeries.
  --no-verify           Do not verify SSL certificates with requests.
  --debug               Print out requests and responses while making
                        requests.
  --random-agent        Use random user-agents for making requests.
  --version             Display the version of XSRFProbe and exit.
  --json                Output the results into a JSON file.
  --force-header-tests  Run Referer/Origin header tests even when an anti-CSRF
                        token is confirmed enforced. Research/opt-in only:
                        bypass requests still carry a valid token, so results
                        on token-protected endpoints are false positives.

Browser Integration:
  --browser             Enable headless Firefox browser for SameSite and
                        browser-dependent tests.
  --auto-validate-poc   Auto-validate generated PoC files in headless browser
                        (requires --browser).
  --geckodriver-path GECKODRIVER_PATH
                        Path to geckodriver binary. Default: assumes
                        geckodriver is in PATH.
  --browser-timeout BROWSER_TIMEOUT
                        Page load timeout for headless browser in seconds.
                        Default: 30.
  --enum-subdomains     Enable subdomain enumeration via crt.sh for
                        SameSite=Strict sibling domain bypass tests.
  --no-form-submit      Do not submit forms during scanning. Only perform
                        passive token detection.