Advanced Usage

XSRFProbe is a toolkit intended to be highly flexible and customisable. Everything the scanner does can be controlled via the config.py configuration file.

XSRFProbe Configuration Variables:

If you don't want to pass parameters on every run, you can edit config.py directly and set your defaults there. Most command-line arguments simply overwrite one of these variables at startup, so anything you can do with a flag you can also pin as a default here.

The following are the options you can modify according to your needs:

Scan target & crawling

• SITE_URL - The main site/endpoint to scan. Set by -u/--url.
• CRAWL_SITE - Whether to crawl the site. Setting this to True is equivalent to supplying --crawl.
• CRAWL_MAX_URLS - Hard cap on the number of URLs fetched while crawling (0 = unlimited). Default 200. Equivalent to --max-urls.
• CRAWL_MAX_DEPTH - Maximum link depth from the seed URL (0 = unlimited). Default 5. Equivalent to --max-depth.
• CRAWL_TIMEOUT - Wall-clock budget for crawling in seconds (0 = unlimited). Default 0. Equivalent to --crawl-timeout.
• EXCLUDE_DIRS - A Python list of directories to exclude from the scan. Equivalent to -E/--exclude.

Requests & identity

• USER_AGENT - The user-agent used for requests. Defaults to a standard Chrome-on-Windows-10 string. Equivalent to --user-agent.
• USER_AGENT_RANDOM - When True, each request uses a different user-agent (not recommended). Equivalent to --random-agent.
• COOKIE_VALUE - A list of cookies passed with every request. A session cookie is recommended for a complete assessment (see why). Equivalent to -c/--cookie.
• HEADER_VALUES - A Python dictionary of default headers. Headers supplied via -H/--headers are appended to this set.
• TIMEOUT_VALUE - HTTP request timeout in seconds. Default 7. Equivalent to -t/--timeout.
• DELAY_VALUE - Delay between requests in seconds. Default 0. Equivalent to -d/--delay.
• VERIFY_CERT - Whether to verify SSL certificates. Setting this to False is equivalent to --no-verify.

Which tests run

• TOKEN_CHECKS - Toggles anti-CSRF token presence and tamper tests. Recommended True.
• REFERER_ORIGIN_CHECKS - Toggles the Referer and Origin header checks. Recommended True.
• COOKIE_BASED - Toggles the cookie & SameSite checks. Recommended True; supply a cookie for full efficiency.
• FORM_SUBMISSION - When True (default) forms are actively submitted to probe token validation. Setting it to False performs passive-only token detection and misses most POST-Based CSRFs. Equivalent to --no-form-submit.
• FORCE_HEADER_TESTS - Forces Referer/Origin tests to run even when a token is confirmed enforced (research/opt-in only). Equivalent to --force-header-tests.
• SCAN_ANALYSIS - Toggles the post-scan token predictability analysis. Setting to False is equivalent to --no-analysis.
• POC_GENERATION - Toggles PoC generation for proven bypasses. Setting to False is equivalent to --skip-poc.

Detection engine tuning

• SIMILARITY_THRESHOLD - The default body-similarity percentage (0–100) the diff engine uses to decide whether a response matches the success baseline. The per-endpoint threshold is auto-calibrated around this value. Default 90.
• TOKEN_GENERATION_LENGTH - Length of the synthetic/forged token values generated during the tamper tests (and the fallback length for filling form fields). Default 6. Equivalent to --max-chars.
• REFERER_URL - The Referer value used in the baseline Referer validation check.
• ORIGIN_URL - The Origin value used in the Origin null/absent checks.
• EMAIL_VALUE / TEXT_VALUE - Default values used when filling email and text-like form fields.
• INPUT_TYPES_DEFAULTS - A dictionary mapping HTML input types to the default value used when auto-filling forms.

Output & verbosity

• OUTPUT_DIR - The directory where the report and PoCs are stored (results are keyed per host). Set by -o/--output.
• JSON_OUTPUT - When True, writes a structured report.json. Equivalent to --json.
• DEBUG - When True, prints requests/responses as they are made. Equivalent to --debug.
• DEBUG_LEVEL - The numeric logging level (25 = PROGRESS, showing phase summaries). Lower values (e.g. via -v/-vv) increase verbosity.

Browser integration

• BROWSER_ENABLED - Enables headless Firefox for the browser-dependent SameSite tests. Equivalent to --browser.
• AUTO_VALIDATE_POC - Opens each generated PoC in the browser to confirm it fires. Equivalent to --auto-validate-poc.
• GECKODRIVER_PATH - Path to the geckodriver binary (defaults to your PATH). Equivalent to --geckodriver-path.
• BROWSER_TIMEOUT - Page-load timeout for the headless browser in seconds. Default 30. Equivalent to --browser-timeout.
• ENUM_SUBDOMAINS - Enables crt.sh subdomain enumeration for the SameSite=Strict sibling-domain test. Equivalent to --enum-subdomains.

With this knowledge you can fully customise and manipulate XSRFProbe according to your needs and requirements.