Home

Welcome to the XSRFProbe Wiki!

Lets get started with the documentation!

Getting Started

Knowing the basics and compatibilities and setting XSRFProbe up.

• Compatibility
  • Python Versions
  • Operating Systems
  • Colors
  • Dependencies
• Installation

Using XSRFProbe

Documentation about using XSRFProbe for a general as well as an advanced user.

• General Usage
  • XSRFProbe Arguments List
  • Testing a Single Endpoint
  • Crawling the Site
  • Bounding the Crawl
  • Adding Cookies for Requests
  • Using Custom User-Agent
  • HTTP Request Timeout
  • HTTP Request Delay
  • Using Custom HTTP Headers
  • Using Random User-Agents
  • Form Field Character Generation
  • Excluding Out of Scope Directories
  • Skipping Form Submission
  • Controlling Verbosity
  • Generating PoC Forms
  • Skipping PoC Generation
  • Skipping Post-Scan Analysis
  • Forcing Referer/Origin Tests
  • Disabling SSL Verification
  • Debugging Requests
  • Browser Integration
  • JSON Output
  • Specifying Output Directory
  • XSRFProbe Version
• Advanced Usage
  • Environment Configuration Variables

Some Common FAQs

Discussions and answers to questions on topics which a user should understand.

• Why should I supply cookies?
• Why is using random-user-agents not recommended?
• What if I want my own custom headers while making requests?
• What about form field generation?
• I have some directories which I don't want to scan, is it possible?
• During scanning I received a HTTPError, what happened?
• I am getting VULNERABLE in various endpoints, but they're not. Why?
• How do I know if this tool actually works?
• Are there different color codes?

XSRFProbe Internals

Documentation on how XSRFProbe works, its scan pipeline, test cases and accuracy. Intended for developers exclusively.

• Understanding How XSRFProbe Works
  • The Scan Pipeline
  • Test Catalog
    • Token Presence Checks
    • Token Tampering Tests
    • Method Override & Content-Type Bypasses
    • Origin Validation Checks
    • Referer Validation Checks
    • Cookie & SameSite Checks
    • Token Encoding Detection
    • Browser-Based SameSite Bypasses
    • Post-Scan Token Analysis
  • Severity and Exploitability
  • Proof of Concept Generation

Contributing

Documentation on tips, and guidelines how a developer should contribute to XSRFProbe.

• Contributing to XSRFProbe
  • Conditions
  • New Pull Requests
  • Coding Style Tips

Reporting Bugs

Guidelines on how you should submit bugs.

• Before Submission
• How to Submit
  • Avoiding Duplicates
  • Full Description
  • Runtime Environment
  • Reproduction Steps
  • Potential Cause/Fix