Home

Welcome to the XSRFProbe wiki!

NOTE:

The wiki is currently under development. Check back later for the complete version. :)

Getting Started

• Compatibility
  • Python Versions
  • Operating Systems
  • Colors
  • Dependencies
• Installation

Using XSRFProbe

• General Usage
  • XSRFProbe Arguments List
  • Adding the Main Domain
  • Adding Cookies for Requests
  • Using Custom User-Agent
  • HTTP Request Timeout
  • HTTP Request Delay
  • Using Custom HTTP Headers
  • Using Random User-Agents
  • Form Field Character Generation
  • Excluding Out of Scope Directories
  • Controlling Verbosity
  • Skipping Post-Scan Analysis
  • Updating XSRFProbe
  • XSRFProbe Version
• Advanced Usage
  • Environment Configuration Variables

XSRFProbe Internals

• Understanding how XSRFProbe Works Under the Hood
  • Types of Checks
    • Origin Based Forgery Checks
    • Referer Based Forgery Checks
    • Anti-CSRF Token Detection
    • Token Strength Calculation
    • Token Randomness Calculation
    • Cookie Persistence
    • Cookie Flag Checks
    • POST-Based Request Forgery Checks
    • Request Tampering and Forging
    • Post-Scan Analysis

Contributing

You are most welcome to contribute to XSRFProbe. Raise an issue or start up a pull request!

Reporting Bugs

This is a beta release , and I know ofc that there will be bugs, feel free to voice you concerns via the issue-tracker on GitHub. However, if it is a dependency issue, you must state:

• Whether you've followed the installation steps correctly.
• Whether you're using Python version 3.x or not.
• The Operating System you're running XSRFProbe on.
• A complete trace output of what the error is. issues raised without these infos are likely not to be attended to.