pax_global_header00006660000000000000000000000064136143200130014503gustar00rootroot0000000000000052 comment=03b9a9b9f57c4925150a345705ea39870374d788 XSRFProbe-2.3.1/000077500000000000000000000000001361432001300132605ustar00rootroot00000000000000XSRFProbe-2.3.1/.editorconfig000066400000000000000000000003221361432001300157320ustar00rootroot00000000000000root = true [*] indent_style = space end_of_line = lf insert_final_newline = true charset = utf-8 trim_trailing_whitespace = true [*.py] indent_size = 4 [{*.bat,Makefile}] indent_style = tab indent_size = 4 XSRFProbe-2.3.1/.github/000077500000000000000000000000001361432001300146205ustar00rootroot00000000000000XSRFProbe-2.3.1/.github/ISSUE_TEMPLATE/000077500000000000000000000000001361432001300170035ustar00rootroot00000000000000XSRFProbe-2.3.1/.github/ISSUE_TEMPLATE/BUG_REPORT.md000066400000000000000000000016551361432001300210440ustar00rootroot00000000000000--- name: Bug report about: Create a report to help us improve labels: --- #### Describe the bug [A clear and concise description of what the bug is] #### Command You Used [The command you entered into the terminal when you faced this error] #### Full Stack Trace Error [Add screenshots or paste terminal output trace error to help explain your problem. #### Potential cause or fix [Do you know what could be causing the problem or how to fix it?] #### Environment: - __OS__: [e.g. Kali Rolling 2018.2] - __Python version__: [e.g. v3.7] #### Some Questions - [ ] I am using the latest version of XSFRProbe. - [ ] I installed the dependecies using `pip3` instead of `pip`. - [ ] I have read the documentation before submitting this issue. - [ ] I have checked the other issues to see if someone reported this before. #### Other stuff [Something else you want the author to know?] XSRFProbe-2.3.1/.github/ISSUE_TEMPLATE/FEATURE_REQUEST.md000066400000000000000000000006721361432001300216350ustar00rootroot00000000000000--- name: Feature request about: Suggest an idea for this project labels: --- ##### Is your feature request related to a problem? Please describe. [A clear and concise description of what the problem is. Ex. I'm always frustrated when ...] ##### Describe the solution you'd like [A clear and concise description of what you want to happen.] ##### Additional context [Add any other context or screenshots about the feature request here.] XSRFProbe-2.3.1/.github/PULL_REQUEST_TEMPLATE.md000066400000000000000000000021011361432001300204130ustar00rootroot00000000000000#### Which category is this pull request? - [ ] A new feature/enhancement. - [ ] Fix an issue/feature-request. - [ ] An improvement to existing modules. - [ ] Other (Please mention below). #### Where has this been tested? - Python Version: [eg. v3.7] - Operating System: [eg. Kali Rolling] #### Does this close any currently open issues? [Mention any issue which this PR closes] #### Does this add any new dependency? [Mention if this PR includes any new library] #### Does this add any new command line switch/option? #### Any other comments you would like to make? [Anything more you'd want the reviewer to know] #### Some Questions - [ ] I have documented my code. - [ ] My code follows the PEP 8 style guide. - [ ] I have tested my build before submitting the pull request. XSRFProbe-2.3.1/.gitignore000066400000000000000000000011511361432001300152460ustar00rootroot00000000000000# Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *.swp # C extensions *.so # Distribution / packaging .Python env/ bin/ build/ develop-eggs/ dist/ eggs/ include/ lib/ local/ lib64/ man/ parts/ sdist/ var/ *.egg-info/ .installed.cfg *.egg # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .coverage .cache nosetests.xml coverage.xml # Translations *.mo # Mr Developer .mr.developer.cfg .project .pydevproject # Rope .ropeproject # Django stuff: *.log *.pot # Sphinx documentation docs/_build/ .github/* .idea/* .vscode/* xsrfprobe-output/*XSRFProbe-2.3.1/.travis.yml000066400000000000000000000021131361432001300153660ustar00rootroot00000000000000group: travis_latest language: python cache: pip matrix: include: - python: 3.7 dist: xenial # required for Python 3.7 (travis-ci/travis-ci#9069) sudo: required # required for Python 3.7 (travis-ci/travis-ci#9069) install: - python setup.py install - pip install flake8 before_script: # stop the build if there are Python syntax errors or undefined names - flake8 . --count --select=E901,E999,F821,F822,F823 --show-source --statistics # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide - flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --quiet script: # Help message. - xsrfprobe --version - xsrfprobe --help - xsrfprobe -u http://www.webscantest.com --crawl --timeout 5 --max-chars 3 --quiet - xsrfprobe -u http://www.webscantest.com/csrf/csrfpost.php --timeout 10 --random-agent - xsrfprobe -u http://www.webscantest.com/csrf/token.php --timeout 15 --delay 2 --display notifications: on_success: change on_failure: change # `always` will be the setting once code changes slow down XSRFProbe-2.3.1/CODE_OF_CONDUCT.md000066400000000000000000000064361361432001300160700ustar00rootroot00000000000000# Contributor Covenant Code of Conduct ## Our Pledge In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. ## Our Standards Examples of behavior that contributes to creating a positive environment include: * Using welcoming and inclusive language * Being respectful of differing viewpoints and experiences * Gracefully accepting constructive criticism * Focusing on what is best for the community * Showing empathy towards other community members Examples of unacceptable behavior by participants include: * The use of sexualized language or imagery and unwelcome sexual attention or advances * Trolling, insulting/derogatory comments, and personal or political attacks * Public or private harassment * Publishing others' private information, such as a physical or electronic address, without explicit permission * Other conduct which could reasonably be considered inappropriate in a professional setting ## Our Responsibilities Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. ## Scope This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project lead at theinfecteddrake@gmail.com. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. ## Attribution This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html [homepage]: https://www.contributor-covenant.org For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq XSRFProbe-2.3.1/LICENSE000066400000000000000000001045141361432001300142720ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read .XSRFProbe-2.3.1/README.md000066400000000000000000000137271361432001300145510ustar00rootroot00000000000000


xsrfprobe

XSRFProbe

The Prime Cross Site Request Forgery Audit & Exploitation Toolkit.

### About: __XSRFProbe__ is an advanced [Cross Site Request Forgery](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)) (CSRF/XSRF) Audit and Exploitation Toolkit. Equipped with a powerful crawling engine and numerous systematic checks, it is able to detect most cases of CSRF vulnerabilities, their related bypasses and futher generate (maliciously) exploitable proof of concepts with each found vulnerability. For more info on how XSRFProbe works, see [XSRFProbe Internals](https://github.com/0xInfection/XSRFProbe/wiki#xsrfprobe-internals) on [wiki](https://github.com/0xInfection/XSRFProbe/wiki/). xsrf-logo

XSRFProbe Wiki • Getting Started • General Usage • Advanced Usage • XSRFProbe Internals • Gallery

### Some Features: - [x] Performs [several types of checks](https://github.com/0xInfection/XSRFProbe/wiki/XSRFProbe-Internals#types-of-checks) before declaring an endpoint as vulnerable. - [x] Can detect several types of Anti-CSRF tokens in POST requests. - [x] Works with a powerful crawler which features continuous crawling and scanning. - [x] Out of the box support for custom cookie values and generic headers. - [x] Accurate [Token-Strength Detection](https://github.com/0xInfection/XSRFProbe/wiki/XSRFProbe-Internals#token-randomness-calculation) and [Analysis](https://github.com/0xInfection/XSRFProbe/wiki/XSRFProbe-Internals#post-scan-token-analysis) using various algorithms. - [x] Can generate both normal as well as maliciously exploitable CSRF proof of concepts. - [x] Well [documented code](https://github.com/0xInfection/XSRFProbe/tree/master?files=1) and [highly generalised automated workflow](https://github.com/0xInfection/XSRFProbe/wiki#xsrfprobe-internals). - [x] The user is in [control of everything](https://github.com/0xInfection/XSRFProbe/wiki/Advanced-Usage#xsrfprobe-configuration-variables) whatever the scanner does. - [x] Has a user-friendly interaction environment with full verbose support. - [x] Detailed logging system of errors, vulnerabilities, tokens and other stuffs. ### Gallery: Lets see some real-world scenarios of XSRFProbe in action: ### Usage: > For the full usage info, please take a look at the wiki's — [General Usage](https://github.com/0xinfection/xsrfprobe/wiki/general-usage) and [Advanced Usage](https://github.com/0xinfection/xsrfprobe/wiki/advanced-usage). #### Installing via Pypi: XSRFProbe can be easily installed via a single command: ``` pip install xsrfprobe ``` #### Installing manually: - For the basics, the first step is to install the tool: ``` python3 setup.py install ``` - Now, the tool can be fired up via: ``` xsrfprobe --help ``` - After testing XSRFProbe on a site, an output folder is created in your present working directory as `xsrfprobe-output`. Under this folder you can view the detailed logs and information collected during the scans. ### Version and License: XSRFProbe `v2.3` release is a `Stage 5 Production-Ready (Stable)` release and the work is licensed under the [GNU General Public License (GPLv3)](https://www.gnu.org/licenses/gpl-3.0.en.html). ### Warnings: Do not use this tool on a live site! It is because this tool is designed to perform all kinds of form submissions automatically which can sabotage the site. Sometimes you may screw up the database and most probably perform a DoS on the site as well. Test on a disposable/dummy setup/site! ### Disclaimer: Usage of XSRFProbe for testing websites without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. The author assumes no liability and is not exclusively responsible for any misuse or damage caused by this program. ### Author's Words: This project is based __entirely upon my own research and my own experience with web applications__ on Cross-Site Request Forgery attacks. You can try going through the source code which is highly documented to help you understand how this toolkit was built. Useful [pull requests](https://github.com/0xInfection/XSRFProbe/wiki/Contributing), [ideas and issues](https://github.com/0xInfection/XSRFProbe/wiki/Reporting-Bugs#before-submitting) are highly welcome. If you wish to see what how XSRFProbe is being developed, check out the [Development Board](https://github.com/0xInfection/XSRFProbe/projects/1). > Copyright © [@0xInfection](https://www.twitter.com/0xInfection) XSRFProbe-2.3.1/setup.py000066400000000000000000000026701361432001300147770ustar00rootroot00000000000000#!/usr/bin/env python import io from setuptools import setup, find_packages from os import path this_directory = path.abspath(path.dirname(__file__)) with io.open(path.join(this_directory, 'README.md'), encoding='utf-8') as f: desc = f.read() setup( name='xsrfprobe', version=__import__('xsrfprobe').__version__, description='The Prime Cross Site Request Forgery (CSRF) Audit & Exploitation Toolkit', long_description=desc, long_description_content_type='text/markdown', author='Pinaki Mondal', author_email='theinfecteddrake@gmail.com', license='GPLv3', url='https://github.com/0xInfection/XSRFProbe', download_url='https://github.com/0xInfection/XSRFProbe/archive/v2.3.0.zip', packages=find_packages(), scripts=['xsrfprobe/bin/xsrfprobe'], install_requires=[ 'requests', 'bs4', 'stringdist', 'tld', 'yattag' ], classifiers=[ 'Development Status :: 5 - Production/Stable', 'Intended Audience :: System Administrators', 'Intended Audience :: Developers', 'Intended Audience :: Information Technology', 'Operating System :: OS Independent', 'Topic :: Internet', 'Topic :: Security', 'License :: OSI Approved :: GNU General Public License v3 (GPLv3)', 'Programming Language :: Python :: 3', ], keywords=['csrf', 'xsrf', 'appsec', 'vulnerability scanner', 'webapps', 'hacking'], ) XSRFProbe-2.3.1/xsrfprobe-output/000077500000000000000000000000001361432001300166305ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe-output/example.com/000077500000000000000000000000001361432001300210405ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe-output/example.com/errored.log000077500000000000000000000000731361432001300232100ustar00rootroot00000000000000(i) http://example.com/csrf -> No standard form "action". XSRFProbe-2.3.1/xsrfprobe-output/example.com/example.com-csrf-poc.html000077500000000000000000000007651361432001300256630ustar00rootroot00000000000000 CSRF PoC

Your CSRF PoC


(i) This form was generated by XSRFProbe . XSRFProbe-2.3.1/xsrfprobe-output/example.com/forms-tested.log000077500000000000000000000002061361432001300241600ustar00rootroot00000000000000(i) http://example.com/csrf:
XSRFProbe-2.3.1/xsrfprobe-output/example.com/strengths.log000077500000000000000000000002141361432001300235640ustar00rootroot00000000000000[+] http://example.com/csrf -> No Persistent Session Cookies. [+] http://example.com/csrf -> Anti-CSRF token is not a string encoded value. XSRFProbe-2.3.1/xsrfprobe-output/example.com/vulnerabilities.log000077500000000000000000000037351361432001300247570ustar00rootroot00000000000000[!] http://example.com/csrf -> No Referer Header based Request Validation presence. [i] Response Headers: {'Date': 'Fri, 28 Dec 2018 07:07:43 GMT', 'Set-Cookie': 'TEST_SESSIONID=jhf8avl5; path=/, NB_SRVID=srv140700; path=/', 'Expires': 'Thu, 19 Nov 1981 08:52:00 GMT', 'Cache-Control': 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Pragma': 'no-cache', 'Vary': 'Accept-Encoding', 'Content-Encoding': 'gzip', 'Content-Length': '663', 'Connection': 'close', 'Content-Type': 'text/html'} [!] http://example.com/csrf -> No Origin Header based request validation presence. [i] Response Headers: {'Date': 'Fri, 28 Dec 2018 07:07:45 GMT', 'Set-Cookie': 'TEST_SESSIONID=1cgnr23oqil463c6; path=/, NB_SRVID=srv140717; path=/', 'Expires': 'Thu, 19 Nov 1981 08:52:00 GMT', 'Cache-Control': 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Pragma': 'no-cache', 'Vary': 'Accept-Encoding', 'Content-Encoding': 'gzip', 'Content-Length': '663', 'Connection': 'close', 'Content-Type': 'text/html'} [!] http://example.com/csrf -> No Cookie Validation on Cross-Origin Requests. [i] Headers: {'Date': 'Fri, 28 Dec 2018 07:07:50 GMT','Set-Cookie': 'TEST_SESSIONID=3f9054b0g2; path=/, NB_SRVID=srv140717; path=/', 'Expires': 'Thu, 19 Nov 1981 08:52:00 GMT', 'Cache-Control': 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Pragma': 'no-cache', 'Vary': 'Accept-Encoding', 'Content-Encoding': 'gzip', 'Content-Length': '663', 'Connection': 'close', 'Content-Type': 'text/html'} [!] http://example.com/csrf -> Form Requested Without Anti-CSRF Token. [i] Form Requested:
[i] Request Query: {'csrf_it': 'PBgCWG'} [!] http://example.com/csrf -> POST-Based Request Forgery on Forms. [i] Form:
[i] POST Query: {'csrf_it': 'PBgCWG'} XSRFProbe-2.3.1/xsrfprobe/000077500000000000000000000000001361432001300152725ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/__init__.py000066400000000000000000000004321361432001300174020ustar00rootroot00000000000000#!/usr/bin/env python3 # coding: utf-8 #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe __version__ = '2.3.0' __license__ = 'GNU General Public License v3 (GPLv3)' XSRFProbe-2.3.1/xsrfprobe/bin/000077500000000000000000000000001361432001300160425ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/bin/xsrfprobe000066400000000000000000000004551361432001300200030ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe from xsrfprobe import xsrfprobe if __name__ == '__main__': xsrfprobe.startEngine()XSRFProbe-2.3.1/xsrfprobe/core/000077500000000000000000000000001361432001300162225ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/core/__init__.py000066400000000000000000000002751361432001300203370ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbe XSRFProbe-2.3.1/xsrfprobe/core/banner.py000066400000000000000000000056771361432001300200600ustar00rootroot00000000000000#!/usr/bin/env python3 #coding: utf-8 #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# #Author: 0xInfection #This module requires XSRF-Probe #https://github.com/0xInfection/XSRF-Probe # Just for some fancy benner to appear at beginning import time from xsrfprobe import __version__ from xsrfprobe.core.colors import * def banner(): print('\n\n') time.sleep(0.05) print(color.ORANGE+' _____ _____ _____ _____ _____ ') time.sleep(0.05) print(color.RED+' __'+color.ORANGE+'|'+color.RED+'__ '+color.ORANGE+' |_ '+color.RED+'__'+color.ORANGE+'|'+color.RED+'___ '+color.ORANGE+' |_ '+color.RED+'__'+color.ORANGE+'|'+color.RED+'___ '+color.ORANGE+'|_ '+color.RED+'_'+color.ORANGE+'|'+color.RED+'____ '+color.ORANGE+'|_'+color.RED+' _'+color.ORANGE+'|'+color.RED+'____ '+color.ORANGE+'|_ '+color.RED+' _____ _____ ______ ______ ') time.sleep(0.05) print(color.RED+" \ ` / "+color.ORANGE+'|'+color.RED+'| ___| '+color.ORANGE+'|'+color.RED+'| _ _| '+color.ORANGE+'|'+color.RED+'| ___| '+color.ORANGE+'| '+color.RED+'| _ | '+color.ORANGE+"|"+color.RED+"| _ ,' / \| _ )| ___| ") time.sleep(0.05) print(color.RED+' > < '+color.ORANGE+'|'+color.RED+' `-.`-. '+color.ORANGE+'|'+color.RED+'| \ '+color.ORANGE+'|'+color.RED+'| ___| '+color.ORANGE+'|'+color.RED+' | __| '+color.ORANGE+'|'+color.RED+'| \ | - || |_ { | ___| ') time.sleep(0.05) print(color.RED+' /__/__\ '+color.ORANGE+'_|'+color.RED+'|______| '+color.ORANGE+'_|'+color.RED+'|__|\__\ '+color.ORANGE+' _|'+color.RED+'|___| '+color.ORANGE+' _|'+color.RED+' |___| '+color.ORANGE+' _|'+color.RED+'|__|\__\\\_____/|______)|______| ') time.sleep(0.05) print(color.ORANGE+' |_____| |_____| |_____| |_____| |_____| \n\n') time.sleep(0.05) def banabout(): # some fancy banner stuff :p print(color.BLUE+' [---] '+color.GREY+'XSRFProbe,'+color.RED+' A'+color.ORANGE+' Cross Site Request Forgery '+color.RED+'Audit Toolkit '+color.BLUE+'[---]') time.sleep(0.05) print(color.BLUE+' [---] [---]') time.sleep(0.05) print(color.BLUE+' [---] '+color.PURPLE+' '+color.GREEN+'~ Author : '+color.CYAN+'Pinaki Mondal ~ '+color.BLUE+' [---]') time.sleep(0.05) print(color.BLUE+' [---] '+color.CYAN+' ~ github.com / '+color.GREY+'0xInfection ~ '+color.BLUE+' [---]') time.sleep(0.05) print(color.BLUE+' [---] [---]') time.sleep(0.05) print(color.BLUE+' [---] '+color.ORANGE+' ~ Version '+color.RED+__version__+color.ORANGE+' ~ '+color.BLUE+' [---]\n') time.sleep(0.05) XSRFProbe-2.3.1/xsrfprobe/core/colors.py000066400000000000000000000026551361432001300201050ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import os if os.name != 'nt' and os.name != 'mac': class color: END = '\033[0m' # normal BOLD = '\033[1m' # bold RED = '\033[1;91m' # red GREEN = '\033[1;92m' # green ORANGE = '\033[1;93m' # orange BLUE = '\033[1;94m' # blue PURPLE = '\033[1;95m' # purple UNDERLINE = '\033[4m' # underline CYAN = '\033[1;96m' # cyan GREY = '\033[1;97m' # gray BR = '\033[1;97;41m' # background red BG = '\033[1;97;42m' # background green BY = '\033[1;97;43m' # background yellow O = '\033[1m \033[93m[!]\033[0m ' # information R = '\033[1m \033[91m[-]\033[0m ' # something's not right GR = '\033[1m \033[97m[*]\033[0m ' # processing G = '\033[1m \033[92m[+]\033[0m ' # yay! C = '\033[1m \033[96m[+]\033[0m ' # crawling... else: class color: # no escape sequences END=BOLD=RED=GREEN=ORANGE=BLUE=PURPLE=UNDERLINE=CYAN=GREY=BR=BG=BY='' # no color values O = ' [!] ' R = ' [-] ' GR = ' [*] ' G = ' [+] ' C = ' [+] ' XSRFProbe-2.3.1/xsrfprobe/core/forms.py000066400000000000000000000045011361432001300177220ustar00rootroot00000000000000#!/usr/bin/env python3 # coding: utf-8 #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe def testFormx1(): # an example xsrfprobe-test-form to make sure the stuff works properly ;) test_form_0x01 = """

""" return test_form_0x01 def testFormx2(): # an example of a xsrfprobe-test-form (used drupal) test_form_0x02 = """

Colorlib Contact Form

Contact us for custom quote

""" return test_form_0x02 XSRFProbe-2.3.1/xsrfprobe/core/inputin.py000066400000000000000000000045021361432001300202630ustar00rootroot00000000000000#!/usr/bin/env python3 #coding: utf-8 #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# #Author: 0xInfection (@_tID) #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbe import socket, requests, re from urllib.parse import urlparse from xsrfprobe.core.colors import * from xsrfprobe.core.verbout import verbout from xsrfprobe.files.dcodelist import IP from xsrfprobe.core.logger import ErrorLogger from xsrfprobe.files.config import ( SITE_URL, CRAWL_SITE, VERIFY_CERT ) def inputin(): ''' This module actually parses the url passed by the user. ''' if SITE_URL: web = SITE_URL # If already assigned if 'http' not in web: # add protocol to site web = 'http://' + web try: web0 = urlparse(web).netloc except Exception: web0 = re.search(IP, web).group(0) try: print(O+'Testing site '+color.CYAN+web0+color.END+' status...') socket.gethostbyname(web0) # test whether site is up or not print(color.GREEN+' [+] Site seems to be up!'+color.END) except socket.gaierror: # if site is down print(R+'Site seems to be down...') quit() # We'll test for endpoint only when the --crawl isn't supplied. if not CRAWL_SITE: try: print(O+'Testing '+color.CYAN+web.split('//')[1].split('/', 1)[1]+color.END+' endpoint status...') requests.get(web, verify=VERIFY_CERT) print(color.GREEN+' [+] Endpoint seems to be up!'+color.END) except requests.exceptions.MissingSchema as e: verbout(R, 'Exception at: '+color.GREY+web0) verbout(R, 'Error: Invalid URL Format') ErrorLogger(web0, e.__str__()) quit() except requests.exceptions.HTTPError as e: verbout(R, "HTTP Error: "+web0) ErrorLogger(web0, e.__str__()) quit() except requests.exceptions.ConnectionError as e: verbout(R, 'Connection Aborted: '+web0) ErrorLogger(web0, e.__str__()) quit() except Exception as e: verbout(R, "Exception Caught: "+e.__str__()) ErrorLogger(web0, e.__str__()) quit() if not web0.endswith('/'): web0 = web0 + '/' if web.split('//')[1] == web0: return web, '' return (web, web0) XSRFProbe-2.3.1/xsrfprobe/core/logger.py000066400000000000000000000050461361432001300200600ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import os from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.files.discovered import INTERNAL_URLS, FILES_EXEC, SCAN_ERRORS from xsrfprobe.files.discovered import VULN_LIST, FORMS_TESTED, REQUEST_TOKENS, STRENGTH_LIST def logger(filename, content): ''' This module is for logging all the stuff we found while crawling and scanning. ''' output_file = OUTPUT_DIR + filename + '.log' with open(output_file, 'w+', encoding='utf8') as f: if type(content) is tuple or type(content) is list: for m in content: # if it is list or tuple, it is iterable f.write(m+'\n') else: f.write(content) # else we write out as it is... ;) f.write('\n') def preqheaders(tup): ''' This module prints out the headers as received in the requests normally. ''' verbout(GR, 'Receiving headers...\n') verbout(color.GREY,' '+color.UNDERLINE+'REQUEST HEADERS'+color.END+color.GREY+':'+'\n') for key, val in tup.items(): verbout(' ',color.CYAN+key+': '+color.ORANGE+val) verbout('','') def presheaders(tup): ''' This module prints out the headers as received in the requests normally. ''' verbout(GR, 'Receiving headers...\n') verbout(color.GREY,' '+color.UNDERLINE+'RESPONSE HEADERS'+color.END+color.GREY+':'+'\n') for key, val in tup.items(): verbout(' ',color.CYAN+key+': '+color.ORANGE+val) verbout('','') def GetLogger(): if INTERNAL_URLS: logger('internal-links', INTERNAL_URLS) if SCAN_ERRORS: logger('errored', SCAN_ERRORS) if FILES_EXEC: logger('files-found', FILES_EXEC) if REQUEST_TOKENS: logger('anti-csrf-tokens', REQUEST_TOKENS) if FORMS_TESTED: logger('forms-tested', FORMS_TESTED) if VULN_LIST: logger('vulnerabilities', VULN_LIST) if STRENGTH_LIST: logger('strengths', STRENGTH_LIST) def ErrorLogger(url, error): con = '(i) '+url+' -> '+error.__str__() SCAN_ERRORS.append(con) def VulnLogger(url, vuln, content=''): tent = '[!] '+url+' -> '+vuln+'\n\n'+str(content)+'\n\n' VULN_LIST.append(tent) def NovulLogger(url, strength): tent = '[+] '+url+' -> '+strength STRENGTH_LIST.append(tent) XSRFProbe-2.3.1/xsrfprobe/core/main.py000066400000000000000000000437231361432001300175310ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # Standard Package imports import os import re import ssl import time import warnings import difflib import http.cookiejar from bs4 import BeautifulSoup try: from urllib.parse import urlencode from urllib.error import HTTPError, URLError from urllib.request import build_opener, HTTPCookieProcessor except ImportError: # Throws exception in Case of Python2 print("\033[1;91m [-] \033[1;93mXSRFProbe\033[0m isn't compatible with Python 2.x versions.\n\033[1;91m [-] \033[0mUse Python 3.x to run \033[1;93mXSRFProbe.") quit() try: import requests, stringdist, bs4 except ImportError: print(' [-] Required dependencies are not installed.\n [-] Run \033[1;93mpip3 install -r requirements.txt\033[0m to fix it.') # Imports from core from xsrfprobe.core.options import * from xsrfprobe.core.colors import * from xsrfprobe.core.inputin import inputin from xsrfprobe.core.request import Get, Post from xsrfprobe.core.verbout import verbout from xsrfprobe.core.prettify import formPrettify from xsrfprobe.core.banner import banner, banabout from xsrfprobe.core.forms import testFormx1, testFormx2 from xsrfprobe.core.logger import ErrorLogger, GetLogger from xsrfprobe.core.logger import VulnLogger, NovulLogger # Imports from files from xsrfprobe.files.config import * from xsrfprobe.files.discovered import FORMS_TESTED # Imports from modules from xsrfprobe.modules import Debugger from xsrfprobe.modules import Parser from xsrfprobe.modules import Crawler from xsrfprobe.modules.Origin import Origin from xsrfprobe.modules.Cookie import Cookie from xsrfprobe.modules.Tamper import Tamper from xsrfprobe.modules.Entropy import Entropy from xsrfprobe.modules.Referer import Referer from xsrfprobe.modules.Encoding import Encoding from xsrfprobe.modules.Analysis import Analysis from xsrfprobe.modules.Checkpost import PostBased # Import Ends # First rule, remove the warnings! warnings.filterwarnings('ignore') def Engine(): # lets begin it! os.system('clear') # Clear shit from terminal :p banner() # Print the banner banabout() # The second banner web, fld = inputin() # Take the input form1 = testFormx1() # Get the form 1 ready form2 = testFormx2() # Get the form 2 ready # For the cookies that we encounter during requests... Cookie0 = http.cookiejar.CookieJar() # First as User1 Cookie1 = http.cookiejar.CookieJar() # Then as User2 if not VERIFY_CERT: context=ssl._create_unverified_context() sslHandler = urllib.request.HTTPSHandler(context=context) resp1 = build_opener(HTTPCookieProcessor(Cookie0), sslHandler) resp2 = build_opener(HTTPCookieProcessor(Cookie1), sslHandler) else: resp1 = build_opener(HTTPCookieProcessor(Cookie0)) resp2 = build_opener(HTTPCookieProcessor(Cookie1)) actionDone = [] # init to the done stuff csrf = '' # no token initialise / invalid token ref_detect = 0x00 # Null Char Flag ori_detect = 0x00 # Null Char Flags form = Debugger.Form_Debugger() # init to the form parser+token generator bs1 = BeautifulSoup(form1).findAll('form', action=True)[0] # make sure the stuff works properly bs2 = BeautifulSoup(form2).findAll('form', action=True)[0] # same as above init1 = web # First init hdrs = [('Cookie', ','.join(cookie for cookie in COOKIE_VALUE))] [hdrs.append((k, v)) for k, v in HEADER_VALUES.items()] resp1.addheaders = resp2.addheaders = hdrs resp1.open(init1) # Makes request as User2 resp2.open(init1) # Make request as User1 # Now there are 2 different modes of scanning and crawling here. # 1st -> Testing a single endpoint without the --crawl flag. # 2nd -> Testing all endpoints with the --crawl flag. try: # Implementing the first mode. [NO CRAWL] if not CRAWL_SITE: url = web try: response = Get(url).text verbout(O, 'Trying to parse response...') soup = BeautifulSoup(response) # Parser init except AttributeError: verbout(R, 'No response received, site probably down: '+url) i = 0 # Init user number if REFERER_ORIGIN_CHECKS: # Referer Based Checks if True... verbout(O, 'Checking endpoint request validation via '+color.GREY+'Referer'+color.END+' Checks...') if Referer(url): ref_detect = 0x01 verbout(O, 'Confirming the vulnerability...') # We have finished with Referer Based Checks, lets go for Origin Based Ones... verbout(O, 'Confirming endpoint request validation via '+color.GREY+'Origin'+color.END+' Checks...') if Origin(url): ori_detect = 0x01 # Now lets get the forms... verbout(O, 'Retrieving all forms on ' +color.GREY+url+color.END+'...') for m in Debugger.getAllForms(soup): # iterating over all forms extracted verbout(O,'Testing form:\n'+color.CYAN) formPrettify(m.prettify()) verbout('', '') FORMS_TESTED.append('(i) '+url+':\n\n'+m.prettify()+'\n') try: if m['action']: pass except KeyError: m['action'] = '/' + url.rsplit('/', 1)[1] ErrorLogger(url, 'No standard form "action".') action = Parser.buildAction(url, m['action']) # get all forms which have 'action' attribute if not action in actionDone and action!='': # if url returned is not a null value nor duplicate... # If form submission is kept to True if FORM_SUBMISSION: try: # NOTE: Slow connections may cause read timeouts which may result in AttributeError # So the idea here is tp make requests pretending to be 3 different users. # Now a series of requests will be targeted against the site with different # identities. Refer to XSRFProbe wiki for more info. # # NOTE: Slow connections may cause read timeouts which may result in AttributeError result, genpoc = form.prepareFormInputs(m) # prepare inputs as user 1 r1 = Post(url, action, result) # make request with token values generated as user1 result, genpoc = form.prepareFormInputs(m) # prepare inputs as user 2 r2 = Post(url, action, result) # again make request with token values generated as user2 # Go for cookie based checks if COOKIE_BASED: Cookie(url, r1) # Go for token based entropy checks... try: if m['name']: query, token = Entropy(result, url, r1.headers, m.prettify(), m['action'], m['name']) except KeyError: query, token = Entropy(result, url, r1.headers, m.prettify(), m['action']) # Now its time to detect the encoding type (if any) of the Anti-CSRF token. fnd, detct = Encoding(token) if fnd == 0x01 and detct: VulnLogger(url, 'Token is a string encoded value which can be probably decrypted.', '[i] Encoding: '+detct) else: NovulLogger(url, 'Anti-CSRF token is not a string encoded value.') # Go for token parameter tamper checks. if (query and token): txor = Tamper(url, action, result, r2.text, query, token) o2 = Get(url).text # make request as user2 try: form2 = Debugger.getAllForms(BeautifulSoup(o2))[i] # user2 gets his form except IndexError: verbout(R, 'Form Index Error') ErrorLogger(url, 'Form Index Error.') continue # Making sure program won't end here (dirty fix :( ) verbout(GR, 'Preparing form inputs...') contents2, genpoc = form.prepareFormInputs(form2) # prepare for form 3 as user3 r3 = Post(url, action, contents2) # make request as user3 with user3's form if (POST_BASED) and ((not query) or (txor)): try: if m['name']: PostBased(url, r1.text, r2.text, r3.text, action, result, genpoc, m.prettify(), m['name']) except KeyError: PostBased(url, r1.text, r2.text, r3.text, action, result, genpoc, m.prettify()) else: print(color.GREEN+' [+] The form was requested with a Anti-CSRF token.') print(color.GREEN+' [+] Endpoint '+color.BG+' NOT VULNERABLE '+color.END+color.GREEN+' to POST-Based CSRF Attacks!') NovulLogger(url, 'Not vulnerable to POST-Based CSRF Attacks.') except HTTPError as msg: # if runtime exception... verbout(R, 'Exception : '+msg.__str__()) # again exception :( ErrorLogger(url, msg) actionDone.append(action) # add the stuff done i+=1 # Increase user iteration else: # Implementing the 2nd mode [CRAWLING AND SCANNING]. verbout(GR, "Initializing crawling and scanning...") crawler = Crawler.Handler(init1, resp1) # Init to the Crawler handler while crawler.noinit(): # Until 0 urls left url = next(crawler) # Go for next! print(C+'Testing :> '+color.CYAN+url) # Display what url its crawling try: soup = crawler.process(fld) # Start the parser if not soup: continue # Making sure not to end the program yet... i = 0 # Set count = 0 (user number 0, which will be subsequently incremented) if REFERER_ORIGIN_CHECKS: # Referer Based Checks if True... verbout(O, 'Checking endpoint request validation via '+color.GREY+'Referer'+color.END+' Checks...') if Referer(url): ref_detect = 0x01 verbout(O, 'Confirming the vulnerability...') # We have finished with Referer Based Checks, lets go for Origin Based Ones... verbout(O, 'Confirming endpoint request validation via '+color.GREY+'Origin'+color.END+' Checks...') if Origin(url): ori_detect = 0x01 # Now lets get the forms... verbout(O, 'Retrieving all forms on ' +color.GREY+url+color.END+'...') for m in Debugger.getAllForms(soup): # iterating over all forms extracted FORMS_TESTED.append('(i) '+url+':\n\n'+m.prettify()+'\n') try: if m['action']: pass except KeyError: m['action'] = '/' + url.rsplit('/', 1)[1] ErrorLogger(url, 'No standard "action" attribute.') action = Parser.buildAction(url, m['action']) # get all forms which have 'action' attribute if not action in actionDone and action != '': # if url returned is not a null value nor duplicate... # If form submission is kept to True if FORM_SUBMISSION: try: result, genpoc = form.prepareFormInputs(m) # prepare inputs as user 1 r1 = Post(url, action, result) # make request with token values generated as user1 result, genpoc = form.prepareFormInputs(m) # prepare inputs as user 2 r2 = Post(url, action, result) # again make request with token values generated as user2 if COOKIE_BASED: Cookie(url, r1) # Go for token based entropy checks... try: if m['name']: query, token = Entropy(result, url, r1.headers, m.prettify(), m['action'], m['name']) except KeyError: query, token = Entropy(result, url, r1.headers, m.prettify(), m['action']) ErrorLogger(url, 'No standard form "name".') # Now its time to detect the encoding type (if any) of the Anti-CSRF token. fnd, detct = Encoding(token) if fnd == 0x01 and detct: VulnLogger(url, 'String encoded token value. Token might be decrypted.', '[i] Encoding: '+detct) else: NovulLogger(url, 'Anti-CSRF token is not a string encoded value.') # Go for token parameter tamper checks. if (query and token): txor = Tamper(url, action, result, r2.text, query, token) o2 = Get(url).text # make request as user2 try: form2 = Debugger.getAllForms(BeautifulSoup(o2))[i] # user2 gets his form except IndexError: verbout(R, 'Form Index Error') ErrorLogger(url, 'Form Index Error.') continue # making sure program won't end here (dirty fix :( ) verbout(GR, 'Preparing form inputs...') contents2, genpoc = form.prepareFormInputs(form2) # prepare for form 3 as user3 r3 = Post(url, action, contents2) # make request as user3 with user3's form if (POST_BASED) and ((query == '') or (txor == True)): try: if m['name']: PostBased(url, r1.text, r2.text, r3.text, m['action'], result, genpoc, m.prettify(), m['name']) except KeyError: PostBased(url, r1.text, r2.text, r3.text, m['action'], result, genpoc, m.prettify()) else: print(color.GREEN+' [+] The form was requested with a Anti-CSRF token.') print(color.GREEN+' [+] Endpoint '+color.BG+' NOT VULNERABLE '+color.END+color.GREEN+' to P0ST-Based CSRF Attacks!') NovulLogger(url, 'Not vulnerable to POST-Based CSRF Attacks.') except HTTPError as msg: # if runtime exception... verbout(color.RED, ' [-] Exception : '+color.END+msg.__str__()) # again exception :( ErrorLogger(url, msg) actionDone.append(action) # add the stuff done i+=1 # Increase user iteration # This error usually happens when some sites are protected by some load balancer # example Cloudflare. These domains return a 403 forbidden response in various # contexts. For example when making reverse DNS queries. except HTTPError as e: if str(e.code) == '403': verbout(R, 'HTTP Authentication Error!') verbout(R, 'Error Code : ' +O+ str(e.code)) ErrorLogger(url, e) quit() except URLError as e: # if again... verbout(R, 'Exception at : '+url) # again exception -_- time.sleep(0.4) verbout(O, 'Moving on...') ErrorLogger(url, e) continue # make sure it doesn't stop at exceptions GetLogger() # The scanning has finished, so now we can log out all the links ;) print('\n'+G+"Scan completed!"+'\n') Analysis() # For Post Scan Analysis except KeyboardInterrupt as e: # Incase user wants to exit :') (while crawling) verbout(R, 'User Interrupt!') time.sleep(1.5) Analysis() # For Post scan Analysis print(R+'Aborted!') # say goodbye ErrorLogger('KeyBoard Interrupt', 'Aborted') GetLogger() # The scanning has interrupted, so now we can log out all the links ;) sys.exit(1) except Exception as e: print('\n'+R+'Encountered an error. \n') print(R+'Please view the error log files to view what went wrong.') verbout(R, e.__str__()) ErrorLogger(url, e) GetLogger() XSRFProbe-2.3.1/xsrfprobe/core/options.py000066400000000000000000000211531361432001300202710ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # Importing stuff import argparse, sys, tld import urllib.parse, os, re from xsrfprobe.files import config from xsrfprobe.core.colors import R, G from xsrfprobe.core.updater import updater from xsrfprobe.files.dcodelist import IP from xsrfprobe import __version__, __license__ print(''' \033[1;91mXSRFProbe\033[0m, \033[1;97mA \033[1;93mCross Site Request Forgery \033[1;97mAudit Toolkit\033[0m ''') # Processing command line arguments parser = argparse.ArgumentParser(usage="xsrfprobe -u ") parser._action_groups.pop() # A simple hack to have required argumentsa and optional arguments separately required = parser.add_argument_group('Required Arguments') optional = parser.add_argument_group('Optional Arguments') # Required Options required.add_argument('-u', '--url', help='Main URL to test', dest='url') # Optional Arguments (main stuff and necessary) optional.add_argument('-c', '--cookie', help='Cookie value to be requested with each successive request. If there are multiple cookies, separate them with commas. For example: `-c PHPSESSID=i837c5n83u4, _gid=jdhfbuysf`.', dest='cookie') optional.add_argument('-o', '--output', help='Output directory where files to be stored. Default is the output/ folder where all files generated will be stored.', dest='output') optional.add_argument('-d', '--delay', help='Time delay between requests in seconds. Default is zero.', dest='delay', type=float) optional.add_argument('-q', '--quiet', help='Set the DEBUG mode to quiet. Report only when vulnerabilities are found. Minimal output will be printed on screen. ', dest='quiet', action='store_true') optional.add_argument('-H', '--headers', help='Comma separated list of custom headers you\'d want to use. For example: ``--headers "Accept=text/php, X-Requested-With=Dumb"``.', dest='headers', type=str) optional.add_argument('-v', '--verbose', help='Increase the verbosity of the output (e.g., -vv is more than -v). ', dest='verbose', action='store_true') optional.add_argument('-t', '--timeout', help='HTTP request timeout value in seconds. The entered value may be either in floating point decimal or an integer. Example: ``--timeout 10.0``', dest='timeout', type=(float or int)) optional.add_argument('-E', '--exclude', help='Comma separated list of paths or directories to be excluded which are not in scope. These paths/dirs won\'t be scanned. For example: `--exclude somepage/, sensitive-dir/, pleasedontscan/`', dest='exclude', type=str) # Other Options # optional.add_argument('-h', '--help', help='Show this help message and exit', dest='disp', default=argparse.SUPPRESS, action='store_true') optional.add_argument('--user-agent', help='Custom user-agent to be used. Only one user-agent can be specified.', dest='user_agent', type=str) optional.add_argument('--max-chars', help='Maximum allowed character length for the custom token value to be generated. For example: `--max-chars 5`. Default value is 6.', dest='maxchars', type=int) optional.add_argument('--crawl', help="Crawl the whole site and simultaneously test all discovered endpoints for CSRF.", dest='crawl', action='store_true') optional.add_argument('--no-analysis', help='Skip the Post-Scan Analysis of Tokens which were gathered during requests', dest='skipal', action='store_true') optional.add_argument('--malicious', help='Generate a malicious CSRF Form which can be used in real-world exploits.', dest='malicious', action='store_true') optional.add_argument('--skip-poc', help='Skip the PoC Form Generation of POST-Based Cross Site Request Forgeries.', dest='skippoc', action='store_true') optional.add_argument('--no-verify', help='Do not verify SSL certificates with requests.', dest='no_verify', action='store_true') optional.add_argument('--display', help='Print out response headers of requests while making requests.', dest='disphead', action='store_true') optional.add_argument('--update', help='Update XSRFProbe to latest version on GitHub via git.', dest='update', action='store_true') optional.add_argument('--random-agent', help='Use random user-agents for making requests.', dest='randagent', action='store_true') optional.add_argument('--version', help='Display the version of XSRFProbe and exit.', dest='version', action='store_true') args = parser.parse_args() if not len(sys.argv) > 1: parser.print_help() quit() # Update XSRFProbe to latest version if args.update: updater() quit() # Print out XSRFProbe version if args.version: print('\033[1;96m [+] \033[1;91mXSRFProbe Version\033[0m : v'+__version__) print('\033[1;96m [+] \033[1;91mXSRFProbe License\033[0m : '+__license__+'\n') quit() # Now lets update some global config variables if args.maxchars: config.TOKEN_GENERATION_LENGTH = args.maxchars # Setting custom user-agent if args.user_agent: config.USER_AGENT = args.user_agent # Option to skip analysis if args.skipal: config.SCAN_ANALYSIS = False # Option to skip poc generation if args.skippoc: config.POC_GENERATION = False # Option to generate malicious form if args.malicious: config.GEN_MALICIOUS = True # Updating main root url if not args.version and not args.update: if args.url: # and not args.help: if 'http' in args.url: config.SITE_URL = args.url else: config.SITE_URL = 'http://'+args.url else: print(R+'You must supply a url/endpoint.') # Crawl the site if --crawl supplied. if args.crawl: config.CRAWL_SITE = True # Turning off the display header feature due to too much log generation. config.DISPLAY_HEADERS = False if args.cookie: # Assigning Cookie for cook in args.cookie.split(','): config.COOKIE_VALUE.append(cook) # This is necessary when a cookie value is supplied # Since if the user-agent used to make the request changes # from time to time, the remote site might trigger up # security mechanisms (or worse, perhaps block your ip?) config.USER_AGENT_RANDOM = False # Set the headers displayer to 1 (actively display headers) if args.disphead: config.DISPLAY_HEADERS = True # Set the requests not to verify SSL certificates if args.no_verify: config.VERIFY_CERT = False # Timeout value if args.timeout: config.TIMEOUT_VALUE = args.timeout # Custom header values if specified if args.headers: # NOTE: As a default idea, when the user supplies custom headers, we # simply add the custom headers to a list of existing headers in # files/config.py. # Uncomment the following lines to just reinitialise the headers everytime # they make a request. # #config.HEADER_VALUES = {} for m in args.headers.split(','): config.HEADER_VALUES[m.split('=')[0].strip()] = m.split('=')[1].strip() # nice hack ;) if args.exclude: exc = args.exclude #config.EXCLUDE_URLS = [s for s in exc.split(',').strip()] m = exc.split(',').strip() for s in m: config.EXCLUDE_DIRS.append(urllib.parse.urljoin(config.SITE_URL, s)) if args.randagent: # If random-agent argument supplied... config.USER_AGENT_RANDOM = True # Turn off a single User-Agent mechanism... config.USER_AGENT = '' if config.SITE_URL: try: if args.output: # If output directory is mentioned... try: if not os.path.exists(args.output+tld.get_fld(config.SITE_URL)): os.makedirs(args.output+tld.get_fld(config.SITE_URL)) except FileExistsError: pass config.OUTPUT_DIR = args.output+tld.get_fld(config.SITE_URL) + '/' else: try: os.makedirs('xsrfprobe-output/'+tld.get_fld(config.SITE_URL)) except FileExistsError: pass config.OUTPUT_DIR = 'xsrfprobe-output/'+tld.get_fld(config.SITE_URL) + '/' # When this exception turns out, we know the user has supplied a IP not domain except tld.exceptions.TldDomainNotFound: direc = re.search(IP, config.SITE_URL).group(0) if args.output: # If output directory is mentioned... try: if not os.path.exists(args.output+direc): os.makedirs(args.output+direc) except FileExistsError: pass config.OUTPUT_DIR = args.output+direc + '/' else: try: os.makedirs('xsrfprobe-output/'+direc) except FileExistsError: pass config.OUTPUT_DIR = 'xsrfprobe-output/'+direc + '/' if args.quiet: config.DEBUG = False XSRFProbe-2.3.1/xsrfprobe/core/prettify.py000066400000000000000000000047631361432001300204540ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import re from xsrfprobe.core.colors import * def formPrettify(response): ''' The main aim for this is to beautify the forms that will be displayed on the terminal. ''' highlighted = [] response = response.splitlines() for newLine in response: line = newLine # Find starting tags pattern = re.findall(r"""(<+\w+>)""", line) for grp in pattern: starttag = ''.join(grp) if starttag: line = line.replace(starttag, color.BLUE + starttag + color.END) # Find attributes pattern = re.findall(r'''(\s\w+=)''', line) for grp in pattern: stu = ''.join(grp) if stu: line = line.replace(stu, color.CYAN + stu + color.END) # Find ending tags pattern = re.findall(r'''()''', line) for grp in pattern: endtag = ''.join(grp) if endtag: line = line.replace(endtag, color.CYAN + endtag + color.END) if line != newLine: highlighted.append(line) else: highlighted.append(color.GREY+newLine) for h in highlighted: print(' '+h) def indentPrettify(soup, indent=2): # where desired_indent is number of spaces as an int() pretty_soup = str() previous_indent = 0 # iterate over each line of a prettified soup for line in soup.prettify().split("\n"): # returns the index for the opening html tag '<' current_indent = str(line).find("<") # which is also represents the number of spaces in the lines indentation if current_indent == -1 or current_indent > previous_indent + 2: current_indent = previous_indent + 1 # str.find() will equal -1 when no '<' is found. This means the line is some kind # of text or script instead of an HTML element and should be treated as a child # of the previous line. also, current_indent should never be more than previous + 1. previous_indent = current_indent pretty_soup += writeOut(line, current_indent, indent) return pretty_soup def writeOut(line, current_indent, desired_indent): new_line = "" spaces_to_add = (current_indent * desired_indent) - current_indent if spaces_to_add > 0: for i in range(spaces_to_add): new_line += " " new_line += str(line) + "\n" return new_line XSRFProbe-2.3.1/xsrfprobe/core/randua.py000066400000000000000000000067641361432001300200630ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import random import datetime user_agent_list = [ # Chrome 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36', 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36', 'Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36', 'Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36', 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36', 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36', 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36', # Firefox 'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)', 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)', 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)', 'Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)', 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko', 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)', 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)', 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)', # Opera 'Opera/9.80 (X11; Linux x86_64; U; bg) Presto/2.8.131 Version/11.10', 'Opera/9.80 (Windows NT 6.0; U; en) Presto/2.8.99 Version/11.10', 'Opera/9.80 (Windows NT 5.1; U; zh-tw) Presto/2.8.131 Version/11.10', 'Opera/9.80 (Windows NT 6.1; Opera Tablet/15165; U; en) Presto/2.8.149 Version/11.1', 'Opera/9.80 (X11; Linux x86_64; U; Ubuntu/10.10 (maverick); pl) Presto/2.7.62 Version/11.01', 'Opera/9.80 (X11; Linux i686; U; ja) Presto/2.7.62 Version/11.01', 'Opera/9.80 (X11; Linux i686; U; fr) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.1; U; zh-tw) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.1; U; sv) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.1; U; en-US) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.1; U; cs) Presto/2.7.62 Version/11.01', 'Opera/9.80 (Windows NT 6.0; U; pl) Presto/2.7.62 Version/11.01' ] def RandomAgent(): return random.choice(user_agent_list) XSRFProbe-2.3.1/xsrfprobe/core/request.py000066400000000000000000000105711361432001300202700ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import requests, time from urllib.parse import urljoin from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.randua import RandomAgent from xsrfprobe.files.discovered import FILES_EXEC from xsrfprobe.core.logger import presheaders, preqheaders, ErrorLogger # import ends headers = HEADER_VALUES # set the headers # Set Cookie if COOKIE_VALUE: headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) # Set User-Agent if USER_AGENT_RANDOM: headers['User-Agent'] = RandomAgent() if USER_AGENT: headers['User-Agent'] = USER_AGENT def Post(url, action, data): ''' The main use of this function is as a Form Requester [POST]. ''' global headers, TIMEOUT_VALUE, VERIFY_CERT time.sleep(DELAY_VALUE) # If delay param has been supplied verbout(GR, 'Preparing the request...') if DISPLAY_HEADERS: preqheaders(headers) verbout(GR, 'Processing the '+color.GREY+'POST'+color.END+' Request...') main_url = urljoin(url, action) # join url and action try: # Make the POST Request. response = requests.post(main_url, headers=headers, data=data, timeout=TIMEOUT_VALUE, verify=VERIFY_CERT) if DISPLAY_HEADERS: presheaders(response.headers) return response # read data content except requests.exceptions.HTTPError as e: # if error verbout(R, "HTTP Error : "+main_url) ErrorLogger(main_url, e.__str__()) return None except requests.exceptions.ConnectionError as e: verbout(R, 'Connection Aborted : '+main_url) ErrorLogger(main_url, e.__str__()) return None except requests.exceptions.ReadTimeout as e: verbout(R, 'Exception at: '+color.GREY+url) verbout(R, 'Error: Read Timeout. Consider increasing the timeout value via --timeout.') ErrorLogger(url, e.__str__()) return None except ValueError as e: # again if valuerror verbout(R, "Value Error : "+main_url) ErrorLogger(main_url, e.__str__()) return None except Exception as e: verbout(R, "Exception Caught: "+e.__str__()) ErrorLogger(main_url, e.__str__()) return None # if at all nothing happens :( def Get(url, headers=headers): ''' The main use of this function is as a Url Requester [GET]. ''' global TIMEOUT_VALUE, VERIFY_CERT # We do not verify the request while GET requests time.sleep(DELAY_VALUE) # We make requests after the time delay # Making sure the url is not a file if url.split('.')[-1].lower() in (FILE_EXTENSIONS or EXECUTABLES): FILES_EXEC.append(url) verbout(G, 'Found File: '+color.BLUE+url) return None try: verbout(GR, 'Preparing the request...') if DISPLAY_HEADERS: preqheaders(headers) verbout(GR, 'Processing the '+color.GREY+'GET'+color.END+' Request...') req = requests.get(url, headers=headers, timeout=TIMEOUT_VALUE, stream=False, verify=VERIFY_CERT) # Displaying headers if DISPLAY_HEADERS is 'True' if DISPLAY_HEADERS: presheaders(req.headers) # Return the object return req except requests.exceptions.MissingSchema as e: verbout(R, 'Exception at: '+color.GREY+url) verbout(R, 'Error: Invalid URL Format') ErrorLogger(url, e.__str__()) return None except requests.exceptions.ReadTimeout as e: verbout(R, 'Exception at: '+color.GREY+url) verbout(R, 'Error: Read Timeout. Consider increasing the timeout value via --timeout.') ErrorLogger(url, e.__str__()) return None except requests.exceptions.HTTPError as e: # if error verbout(R, "HTTP Error Encountered : "+url) ErrorLogger(url, e.__str__()) return None except requests.exceptions.ConnectionError as e: verbout(R, 'Connection Aborted : '+url) ErrorLogger(url, e.__str__()) return None except Exception as e: verbout(R, "Exception Caught: "+e.__str__()) ErrorLogger(url, e.__str__()) return None XSRFProbe-2.3.1/xsrfprobe/core/updater.py000066400000000000000000000025771361432001300202530ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import os from requests import get from xsrfprobe import __version__ from xsrfprobe.core.colors import * def updater(): ''' Function to update XSRFProbe seamlessly. ''' print(GR+'Checking for updates...') vno = get('https://raw.githubusercontent.com/0xInfection/XSRFProbe/master/xsrfprobe/files/VersionNum').text print(GR+'Version on GitHub: '+color.CYAN+vno.strip()) print(GR+'Version You Have : '+color.CYAN+__version__) if vno != __version__: print(G+'A new version of XSRFProbe is available!') current_path = os.getcwd().split('/') # if you know it, you know it folder = current_path[-1] # current directory name path = '/'.join(current_path) # current directory path choice = input(O+'Would you like to update? [Y/n] :> ').lower() if choice != 'n': print(GR+'Updating XSRFProbe...') os.system('git clone --quiet https://github.com/0xInfection/XSRFProbe %s' % (folder)) os.system('cp -r %s/%s/* %s && rm -r %s/%s/ 2>/dev/null' % (path, folder, path, path, folder)) print(G+'Update successful!') else: print(G+'XSRFProbe is up to date!') quit() XSRFProbe-2.3.1/xsrfprobe/core/utils.py000066400000000000000000000040461361432001300177400ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe from difflib import SequenceMatcher def sameSequence(str1,str2): ''' This function is intended to find same sequence between str1 and str2. ''' # Initialize SequenceMatcher object with # Input string seqMatch = SequenceMatcher(None, str1, str2) # Find match of longest sub-string # Output will be like Match(a=0, b=0, size=5) match = seqMatch.find_longest_match(0, len(str1), 0, len(str2)) # Print longest substring if (match.size!=0): return (str1[match.a: match.a + match.size]) else: return '' def replaceStrIndex(text, index=0, replacement=''): ''' This method returns a tampered string by replacement ''' return '%s%s%s' % (text[:index], replacement, text[index+1:]) def checkDuplicates(iterable): ''' This function works as a byte sequence checker for tuples passed onto this function. ''' seen = set() for x in iterable: if x in seen: return True seen.add(x) return False def byteString(s, encoding='utf8'): """ Return a byte-string version of 's', Encoded as utf-8. """ try: s = s.encode(encoding) except (UnicodeEncodeError, UnicodeDecodeError): s = str(s) return s def subSequence(str1,str2): ''' Returns whether 'str1' and 'str2' are subsequence of one another. ''' j = 0 # Index of str1 i = 0 # Index of str2 # Traverse both str1 and str2 # Compare current character of str2 with # First unmatched character of str1 # If matched, then move ahead in str1 m = len(str1) n = len(str2) while j (3 - args.verbose): # print verb_args[1] XSRFProbe-2.3.1/xsrfprobe/files/000077500000000000000000000000001361432001300163745ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/files/VersionNum000066400000000000000000000000061361432001300204200ustar00rootroot000000000000002.3.0 XSRFProbe-2.3.1/xsrfprobe/files/__init__.py000066400000000000000000000003231361432001300205030ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbe XSRFProbe-2.3.1/xsrfprobe/files/config.py000066400000000000000000000141741361432001300202220ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # this module holds values for controlling the entire scan interface. # Lets assign some global variables... global SITE_URL, DEBUG, USER_AGENT, USER_AGENT_RANDOM, COOKIE_BASED, COOKIE_VALUE global HEADER_VALUES, TIMEOUT_VALUE, REFERER_ORIGIN_CHECKS, REFERER_URL, POST_BASED global DISPLAY_HEADERS, EXECUTABLES, FILE_EXTENSIONS, POC_GENERATION, OUTPUT_DIR, VERIFY_CERT global CRAWL_SITE, TOKEN_CHECKS, DELAY_VALUE, SCAN_ANALYSIS, EXCLUDE_DIRS, GEN_MALICIOUS # Site Url to be scanned (Required) SITE_URL = '' # Switch for whether to crawl the site or not CRAWL_SITE = False # Print out verbose (turn it off for only brief outputs). # Turning off is Highly Discouraged, since you will miss what the tool is doing. DEBUG = True # Debug level of the output (beta test feature) DEBUG_LEVEL = 3 # User-Agent to be used (If COOKIE_VALUE is not supplied) USER_AGENT_RANDOM = False # User-Agent to be used (If COOKIE_VALUE supplied). # # This is standard User-Agent emulating Chrome 68 on Windows 10 # # NOTE: This is a precaution in case the cookie value is supplied, # if the user-agent gets changed from time to time, the remote # application might trigger up some protection agents USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36' # Cookie value to be sent alongwith the requests. This option is particularly # needed for a wholesome check on CSRFs. Since for a basic successful CSRF attack # one needs to have a site with long-duration persistent session cookies and no # Referer validation. # # Also you might want to keep this value to '' untill you want to scan your # web application as a authorised user/admin with elevated priviledges, # which might give XSRFProbe a wider scope to scan. This is typically # recommended for websites which has logins/sessions feature. (eg. Social # Networking Sites, E-Commerce Sites). # # NOTE: If this value is not supplied, XSRFProbe will only scan for simple # cookies which the tool might encounter while making requests, especially # POST requests. COOKIE_VALUE = [] # Header values to be used (Modify it as per your need) HEADER_VALUES = { 'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'Accept-Language' : 'en-US,en;q=0.9', 'Accept-Encoding' : 'gzip, deflate, br', 'Sec-Fetch-Mode' : 'navigate', 'DNT' : '1', # Do Not Track Request Header :D 'Connection' : 'close' } # Email value to be supplied when parsing/filling forms # You can modify it as per your need :) EMAIL_VALUE = 'csrf.testing@xsrfprobe.tld' # Plaintext value to be supplied when parsing/filling forms TEXT_VALUE = 'csrftesting' # Request Timeout (Keep the max. timeout value to 10s) TIMEOUT_VALUE = 7 # The time delay between requests. This option is especially required # when there is some sort of security measure such as load-balancers # or a Firewall (WAF). DELAY_VALUE = 0 # Whether to include Cookie Based Checks everywhere # # Note: If you keep this to 'True', you must supply a # cookie value in COOKIE_VALUE to test with full efficiency. # Otherwise only a partial check will be done against the cookies # which XSRFProbe might come across while requesting forms/data # and other relevant areas. # # (Recommended Keeping True) COOKIE_BASED = True # Include checks for Form Based CSRFs (POST method) # (Recommended keeping True) POST_BASED = True # Anti-CSRF Token Checks (Recommended keeping True) TOKEN_CHECKS = True # Referer/Origin Checks (Recommended keeping True) REFERER_ORIGIN_CHECKS = True # Whether to submit Crafted Forms (Recommended keeping True) # If you turn this to False, it will omit form submissions, # so there will be more chances of missing out most possible # cases of Form based (POST Based) CSRFs. FORM_SUBMISSION = True # A switch to determine whether to verify certificates upon # requests. This will help devs test their web-app with self-signed # certificates. VERIFY_CERT = True # Referer Url (Change It Accordingly) # eg. Use one of your Subdomains (Same Origin Policy)) REFERER_URL = 'http://not-a-valid-referer.xsrfprobe-csrftesting.0xinfection.xyz' # Origin Url (Change It Accordingly) # eg. Use one of your Subdomains (Same Origin Policy)) ORIGIN_URL = 'http://not-a-valid-origin.xsrfprobe-csrftesting.0xinfection.xyz' # The length of the custom token to be generated for params # # The recommended value I prefer is 6. Greater value might # result in database problems. since every form on the server # will be submitted 5+ times for various methods of CSRF attacks. # # Lower value wll not harm but it will make it difficult # identifying request parameters and token values in a. TOKEN_GENERATION_LENGTH = 6 # List of Urls that are not to be scanned (excluded). EXCLUDE_DIRS = [] # Output directory where everything (including logs) are to # be stored OUTPUT_DIR = '' # This option is for displaying the headers received as response. # Turn this off if you don't want to see the headers on the # terminal, or if it feels irritating. DISPLAY_HEADERS = False # Option for controlling post-scan analysis. Turning it off # results in not analysing the tokens gathered. SCAN_ANALYSIS = True # Option to skip PoC Form Generation of POST_BASED Request Forgeries. # The form will not be generated. POC_GENERATION = True # Option whether or not to generate a malicious CSRF form with all # hidden fields. GEN_MALICIOUS = False # A list of file extensions that might be come across while scanning # and crawling FILE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'pdf', 'js', 'css', 'ico', 'bmp', 'svg', 'json', 'xml', 'xls', 'csv', 'docx',] # These are a list of executable files that are found on the web EXECUTABLES = ['deb', 'bat', 'exe', 'msu', 'msi', 'apk', 'bin', 'csh', 'inf', 'ini', 'msc', 'osx' ,'out', 'vbe', 'ws', 'msp', 'jse'] XSRFProbe-2.3.1/xsrfprobe/files/dcodelist.py000066400000000000000000000123301361432001300207170ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # This file contains various regex expressions for detecting the # encoding type of strings. # Token hash encoding detection db, thanks to a book, Python for Penetation Testers, LOL! HASH_DB = ( ("Blowfish (Eggdrop)", r"^\+[a-zA-Z0-9\/\.]{12}$"), ("Blowfish (OpenBSD)", r"^\$2a\$[0-9]{0,2}?\$[a-zA-Z0-9\/\.]{53}$"), ("Blowfish Crypt", r"^\$2[axy]{0,1}\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("DES (Unix)", r"^.{0,2}[a-zA-Z0-9\/\.]{11}$"), ("MD5 (Unix)", r"^\$1\$.{0,8}\$[a-zA-Z0-9\/\.]{22}$"), ("MD5 (APR)", r"^\$apr1\$.{0,8}\$[a-zA-Z0-9\/\.]{22}$"), ("MD5 (MyBB)", r"^[a-fA-F0-9]{32}:[a-z0-9]{8}$"), ("MD5 (ZipMonster)", r"^[a-fA-F0-9]{32}$"), ("MD5 crypt", r"^\$1\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("MD5 apache crypt", r"^\$apr1\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("MD5 (Joomla)", r"^[a-fA-F0-9]{32}:[a-zA-Z0-9]{16,32}$"), ("MD5 (Wordpress)", r"^\$P\$[a-zA-Z0-9\/\.]{31}$"), ("MD5 (phpBB3)", r"^\$H\$[a-zA-Z0-9\/\.]{31}$"), ("MD5 (Cisco PIX)", r"^[a-zA-Z0-9\/\.]{16}$"), ("MD5 (osCommerce)", r"^[a-fA-F0-9]{32}:[a-zA-Z0-9]{2}$"), ("MD5 (Palshop)", r"^[a-fA-F0-9]{51}$"), ("MD5 (IP.Board)", r"^[a-fA-F0-9]{32}:.{5}$"), ("MD5 (Chap)", r"^[a-fA-F0-9]{32}:[0-9]{32}:[a-fA-F0-9]{2}$"), ("Juniper Netscreen/SSG (ScreenOS)", r"^[a-zA-Z0-9]{30}:[a-zA-Z0-9]{4,}$"), ("Fortigate (FortiOS)", r"^[a-fA-F0-9]{47}$"), ("Minecraft (Authme)", r"^\$sha\$[a-zA-Z0-9]{0,16}\$[a-fA-F0-9]{64}$"), ("Lotus Domino", r"^\(?[a-zA-Z0-9\+\/]{20}\)?$"), ("Lineage II C4", r"^0x[a-fA-F0-9]{32}$"), ("CRC-96 (ZIP)", r"^[a-fA-F0-9]{24}$"), ("NT crypt", r"^\$3\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("Skein-1024", r"^[a-fA-F0-9]{256}$"), ("RIPEMD-320", r"^[A-Fa-f0-9]{80}$"), ("EPi hash", r"^0x[A-F0-9]{60}$"), ("EPiServer 6.x < v4", r"^\$episerver\$\*0\*[a-zA-Z0-9]{22}==\*[a-zA-Z0-9\+]{27}$"), ("EPiServer 6.x >= v4", r"^\$episerver\$\*1\*[a-zA-Z0-9]{22}==\*[a-zA-Z0-9]{43}$"), ("Cisco IOS SHA256", r"^[a-zA-Z0-9]{43}$"), ("oRACLE 11g/12c", r"^(S:)?[a-f0-9]{40}(:)?[a-f0-9]{20}$"), ("SHA-1 (Django)", r"^sha1\$.{0,32}\$[a-fA-F0-9]{40}$"), ("SHA-1 crypt", r"^\$4\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("SHA-1 (Hex)", r"^[a-fA-F0-9]{40}$"), ("SHA-1 (LDAP) Base64", r"^\{SHA\}[a-zA-Z0-9+/]{27}=$"), ("SHA-1 (LDAP) Base64 + salt", r"^\{SSHA\}[a-zA-Z0-9+/]{28,}[=]{0,3}$"), ("SHA-512 (Drupal)", r"^\$S\$[a-zA-Z0-9\/\.]{52}$"), ("SHA-512 crypt", r"^\$6\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("SHA-256 (Django)", r"^sha256\$.{0,32}\$[a-fA-F0-9]{64}$"), ("SHA-256 crypt", r"^\$5\$[a-zA-Z0-9./]{8}\$[a-zA-Z0-9./]{1,}$"), ("SHA-384 (Django)", r"^sha384\$.{0,32}\$[a-fA-F0-9]{96}$"), ("SHA-256 (Unix)", r"^\$5\$.{0,22}\$[a-zA-Z0-9\/\.]{43,69}$"), ("SHA-512 (Unix)", r"^\$6\$.{0,22}\$[a-zA-Z0-9\/\.]{86}$"), ("SHA-384", r"^[a-fA-F0-9]{96}$"), ("SHA-512", r"^[a-fA-F0-9]{128}$"), ("SipHash", r"^[a-f0-9]{16}:2:4:[a-f0-9]{32}$"), ("SSHA-1", r"^({SSHA})?[a-zA-Z0-9\+\/]{32,38}?(==)?$"), ("SSHA-1 (Base64)", r"^\{SSHA\}[a-zA-Z0-9]{32,38}?(==)?$"), ("SSHA-512 (Base64)", r"^\{SSHA512\}[a-zA-Z0-9+]{96}$"), ("Oracle 11g", r"^S:[A-Z0-9]{60}$"), ("SMF >= v1.1", r"^[a-fA-F0-9]{40}:[0-9]{8}&"), ("MySQL 5.x", r"^\*[a-f0-9]{40}$"), ("MySQL 3.x", r"^[a-fA-F0-9]{16}$"), ("OSX v10.7", r"^[a-fA-F0-9]{136}$"), ("OSX v10.8", r"^\$ml\$[a-fA-F0-9$]{199}$"), ("SAM (LM_Hash:NT_Hash)", r"^[a-fA-F0-9]{32}:[a-fA-F0-9]{32}$"), ("MSSQL (2000)", r"^0x0100[a-f0-9]{0,8}?[a-f0-9]{80}$"), ("Cisco Type 7", r"^[a-f0-9]{4,}$"), ("Snefru-256", r"^(\\$snefru\\$)?[a-f0-9]{64}$"), ("MSSQL (2005)", r"^0x0100[a-f0-9]{0,8}?[a-f0-9]{40}$"), ("MSSQL (2012)", r"^0x02[a-f0-9]{0,10}?[a-f0-9]{128}$"), ("TIGER-160 (HMAC)", r"^[a-f0-9]{40}$"), ("SHA-256", r"^[a-fA-F0-9]{64}$"), ("SHA-1 (Oracle)", r"^[a-fA-F0-9]{48}$"), ("SHA-224", r"^[a-fA-F0-9]{56}$"), ("Adler32", r"^[a-f0-9]{8}$"), ("CRC-16-CCITT", r"^[a-fA-F0-9]{4}$"), ("NTLM", r"^[0-9A-Fa-f]{32}$"), ) # IP Regex IP = r'((25[0-5]|2[0-4][0-9]|[1][0-9][0-9]|[1-9][0-9]{0,1})\.){3}(25[0-5]|2[0-4][0-9]|[1][0-9][0-9]|[1-9][0-9]{0,1})' # Get rid of Double ../../ RID_DOUBLE = r'/\.\./' # Get rid of ./'s RID_SINGLE = r'\./' # Complier based regex RID_COMPILE = r'/[^/]*/../' # Number based. NUM_SUB = r'=[0-9]+' # Number based compile. NUM_COM = r'(title=)[^&]*' # Binary strings. BINARY = r'^[01]+$' # Decimal Strings. DEC = r'&#.*;+' # Protocol Types PROTOCOLS = r'(.*\/)[^\/]*'XSRFProbe-2.3.1/xsrfprobe/files/discovered.py000066400000000000000000000015661361432001300211050ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # INFO: This file is for storing the various important parts of # requests discovered during making of various requests. # Vulnerabilities which were noticed VULN_LIST = [] # Strengths or positive sides of the application STRENGTH_LIST = [] # This is for storing the various tokens which got discovered # during making the requests. This will be used for various # analysis of token generation prototypes and logic used in # generating them. REQUEST_TOKENS = [] # List of all Urls that we found INTERNAL_URLS = [] # Files/executables discovered during crawling FILES_EXEC = [] # Forms that were tested FORMS_TESTED = [] # Errors that were encountered SCAN_ERRORS = [] XSRFProbe-2.3.1/xsrfprobe/files/paramlist.py000066400000000000000000000101621361432001300207420ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe # List of anti-CSRF paramter values which are sent for form # verification, I have seen. These values are collected based on # my interactions with different web-applications. :) # # Feel free to add more of your tokens if you have. ;) COMMON_CSRF_NAMES = ( # These are a list of known common tokens parameters 'CSRFName', # OWASP CSRF_Guard 'CSRFToken', # OWASP CSRF_Guard 'csrf_token', # PHP NoCSRF Class 'anticsrf', # AntiCsrfParam.java '__RequestVerificationToken', # ASP.NET TokenParam 'VerificationToken', # AntiCSRFParam.java 'form_build_id', # Drupal CMS AntiCSRF 'nonce', # WordPress Nonce 'authenticity_token', # Ruby on Rails 'csrf_param', # Ruby on Rails 'TransientKey', # VanillaForums Param 'csrf', # PHP CSRFProtect 'AntiCSURF', # Anti CSURF (PHP) 'YII_CSRF_TOKEN', # http://www.yiiframework.com/ 'yii_anticsrf', # http://www.yiiframework.com/ '[_token]', # Symfony 2.x '_csrf_token', # Symfony 1.4 'csrfmiddlewaretoken', # Django 1.5 'ccm_token', # Concrete 5 CMS 'XOOPS_TOKEN_REQUEST', # Xoops CMS '_csrf', # Express JS Default Anti-CSRF # These are some other various token names I have seen in # various websites. # # TODO: Add more similar csrf token parameters 'token', 'auth', 'hash', 'secret', 'verify', ) COMMON_CSRF_HEADERS = ( # These are a list of HTTP Headers often found in requests # of web applications using various frameworks. 'CSRF-Token', # Express JS CSURF Middleware 'XSRF-Token', # Node JS/ Express JS 'X-CSRF-Token', # Ruby on Rails 'X-XSRF-Token', # Express JS CSURF Middleware # Some other probabilties 'X-CSRF-Header', 'X-XSRF-Header', 'X-CSRF-Protection' ) # TODO: Add and replace with more valid and arguable exclusion lists EXCLUSIONS_LIST = ( 'logout', 'action=out', 'action=logoff', 'action=delete', 'UserLogout', 'osCsid', 'action=logout', ) # List of common errors shown when token is tampered. TOKEN_ERRORS = ( 'the required form field', 'token could not', 'invalid token', 'wrong', 'error', 'not valid', 'please check your request', 'your browser did something unexpected', 'csrf' 'clearing your cookies', 'tampered token', 'null', 'unacceptable', 'false', 'void', 'incorrect', 'inoperative', 'faulty', 'absurd', 'inconsistent', 'not acceptable', ) XSRFProbe-2.3.1/xsrfprobe/modules/000077500000000000000000000000001361432001300167425ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/modules/Analysis.py000066400000000000000000000157071361432001300211110ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import stringdist import itertools, time from xsrfprobe.core.colors import * from xsrfprobe.modules.Entropy import calcEntropy from xsrfprobe.core.verbout import verbout from xsrfprobe.core.utils import sameSequence, byteString from xsrfprobe.files.discovered import REQUEST_TOKENS from xsrfprobe.core.logger import VulnLogger, NovulLogger def Analysis(): ''' The main idea behind this is to observe and analyse the patterns in which the CSRF tokens are generated by server. ''' ctr = 0 # Counter variable set to 0 # Checking if the no of tokens is greater than 1 if len(REQUEST_TOKENS) > 1: verbout(color.RED, '\n +--------------+') verbout(color.RED, ' | Analysis |') verbout(color.RED, ' +--------------+\n') print(GR+'Proceeding for post-scan analysis of tokens gathered...') verbout(G, 'A total of %s tokens was discovered during the scan' % (len(REQUEST_TOKENS))) # The idea behind this is to generate all possible combinations (not # considering permutations) from the given list of discovered tokens # and generate anti-CSRF token generation pattern. for tokenx1, tokenx2 in itertools.combinations(REQUEST_TOKENS, 2): try: verbout(GR, 'Analysing 2 Anti-CSRF Tokens from gathered requests...') verbout(color.CYAN, ' [+] First Token: '+color.BLUE+tokenx1) verbout(color.ORANGE, ' [+] Shannon Entropy: '+color.GREEN+'%s' % (calcEntropy(tokenx1))) verbout(color.CYAN, ' [+] Second Token: '+color.BLUE+tokenx2) verbout(color.ORANGE, ' [+] Shannon Entropy: '+color.GREEN+'%s' % (calcEntropy(tokenx2))) # Calculating the edit distance via Damerau Levenshtein algorithm m = stringdist.rdlevenshtein(tokenx1, tokenx2) verbout(color.CYAN, ' [+] Edit Distance Calculated: '+color.GREY+str(m)+'%') # Now its time to detect the alignment ratio n = stringdist.rdlevenshtein_norm(tokenx1, tokenx2) verbout(color.CYAN, ' [+] Alignment Ratio Calculated: '+color.GREY+str(n)) # If both tokens are same, then if len(tokenx1) == len(tokenx2): verbout(C, 'Token length calculated is same: '+color.ORANGE+'Each %s bytes' % len(byteString(tokenx1))) else: verbout(C, 'Token length calculated is different: '+color.ORANGE+'By %s bytes' % (len(byteString(tokenx1)) - len(byteString(tokenx2)))) time.sleep(0.5) # In my experience with web security assessments, often the Anti-CSRF token # is composed of two parts, one of them remains static while the other one dynamic. # # For example, if the Anti CSRF Tokens “837456mzy29jkd911139” for one request, the # other is “837456mzy29jkd337221”, “837456mzy29jkd” part of the token remains same # in both requests. # # The main idea behind this is to detect the static and dynamic part via DL Algorithm # as discussed above by calculating edit distance. p = sameSequence(tokenx1, tokenx2) tokenx01 = tokenx1.replace(p,'') tokenx02 = tokenx2.replace(p,'') if n == 0.5 or m == len(tokenx1)/2: verbout(GR, 'The tokens are composed of 2 parts (one static and other dynamic)... ') verbout(C, 'Static Part : '+color.GREY+p+color.END+' | Length: '+color.CYAN+str(len(p))) verbout(O, 'Dynamic Part of Token 0x1: '+color.GREY+tokenx01+color.END+' | Length: '+color.CYAN+str(len(tokenx01))) verbout(O, 'Dynamic Part of Token 0x2: '+color.GREY+tokenx02+color.END+' | Length: '+color.CYAN+str(len(tokenx02))) if len(len(tokenx1)/2) <= 6: verbout(color.RED,' [-] Post-Analysis reveals that token might be '+color.BR+' VULNERABLE '+color.END+'!') print(color.RED+ ' [+] Possible CSRF Vulnerability Detected!') print(color.ORANGE+' [!] Vulnerability Type: '+color.BR+' Weak Dynamic Part of Tokens '+color.END) print(color.GREY+' [+] Tokens can easily be '+color.RED+'Forged by Bruteforcing/Guessing'+color.END+'!\n') VulnLogger('Analysis', 'Tokens can easily be Forged by Bruteforcing/Guessing.', '[i] Token 1: '+tokenx1+'\n[i] Token 2: '+tokenx2) elif n < 0.5 or m < len(tokenx1)/2: verbout(R, 'Token distance calculated is '+color.RED+'less than 0.5!') verbout(C, 'Static Part : '+color.GREY+p+color.END+' | Length: '+color.CYAN+str(len(p))) verbout(O, 'Dynamic Part of Token 0x1: '+color.GREY+tokenx01+color.END+' | Length: '+color.CYAN+str(len(tokenx01))) verbout(O, 'Dynamic Part of Token 0x2: '+color.GREY+tokenx02+color.END+' | Length: '+color.CYAN+str(len(tokenx02))) verbout(color.RED,' [-] Post-Analysis reveals that token might be '+color.BR+' VULNERABLE '+color.END+'!') print(color.GREEN+ ' [+] Possible CSRF Vulnerability Detected!') print(color.ORANGE+' [!] Vulnerability Type: '+color.BR+' Weak Dynamic Part of Tokens '+color.END) print(color.GREY+' [+] Tokens can easily be '+color.RED+'Forged by Bruteforcing/Guessing'+color.END+'!\n') VulnLogger('Analysis', 'Tokens can easily be Forged by Bruteforcing/Guessing.', '[i] Token 1: '+tokenx1+'\n[i] Token 2: '+tokenx2) else: verbout(R, 'Token distance calculated is '+color.GREEN+'greater than 0.5!') verbout(C, 'Static Part : '+color.GREY+p+color.END+' | Length: '+color.CYAN+str(len(p))) verbout(O, 'Dynamic Part of Token 0x1: '+color.GREY+tokenx01+color.END+' | Length: '+color.CYAN+str(len(tokenx01))) verbout(O, 'Dynamic Part of Token 0x2: '+color.GREY+tokenx02+color.END+' | Length: '+color.CYAN+str(len(tokenx02))) verbout(color.GREEN,' [+] Post-Analysis reveals that tokens are '+color.BG+' NOT VULNERABLE '+color.END+'!') print(color.ORANGE+' [!] Vulnerability Mitigation: '+color.BG+' Strong Dynamic Part of Tokens '+color.END) print(color.GREY+' [+] Tokens '+color.GREEN+'Cannot be Forged by Bruteforcing/Guessing'+color.END+'!\n') NovulLogger('Analysis', 'Tokens cannot be Forged by Bruteforcing/Guessing.') time.sleep(1) except KeyboardInterrupt: ctr+=1 continue print(C+'Post-Scan Analysis Completed!') XSRFProbe-2.3.1/xsrfprobe/modules/Checkpost.py000066400000000000000000000075661361432001300212550ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import re import time import difflib from urllib.parse import urlencode from xsrfprobe.core.colors import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.logger import VulnLogger from xsrfprobe.files.config import POC_GENERATION, GEN_MALICIOUS from xsrfprobe.modules.Generator import GenNormalPoC, GenMalicious def PostBased(url, r1, r2, r3, m_action, result, genpoc, form, m_name=''): ''' This method is for detecting POST-Based Request Forgeries on basis of fuzzy string matching and comparison based on Ratcliff-Obershelp Algorithm. ''' verbout(color.RED, '\n +------------------------------+') verbout(color.RED, ' | POST-Based Forgery Check |') verbout(color.RED, ' +------------------------------+\n') verbout(O, 'Matching response query differences...') checkdiffx1 = difflib.ndiff(r1.splitlines(1), r2.splitlines(1)) # check the diff noted checkdiffx2 = difflib.ndiff(r1.splitlines(1), r3.splitlines(1)) # check the diff noted result12 = [] # an init verbout(O, 'Matching results...') for n in checkdiffx1: if re.match('\+|-', n): # get regex matching stuff only +/- result12.append(n) # append to existing list result13 = [] # an init for n in checkdiffx2: if re.match('\+|-', n): # get regex matching stuff result13.append(n) # append to existing list # This logic is based purely on the assumption on the difference of various requests # and response body. # If the number of differences of result12 are less than the number of differences # than result13 then we have the vulnerability. (very basic check) # # NOTE: The algorithm has lots of scopes of improvement... if len(result12) <= len(result13): print(color.GREEN+ ' [+] CSRF Vulnerability Detected : '+color.ORANGE+url+'!') print(color.ORANGE+' [!] Vulnerability Type: '+color.BR+' POST-Based Request Forgery '+color.END) VulnLogger(url, 'POST-Based Request Forgery on Forms.', '[i] Form: '+form.__str__()+'\n[i] POST Query: '+result.__str__()+'\n') time.sleep(0.3) verbout(O, 'PoC of response and request...') if m_name: print(color.RED+'\n +-----------------+') print(color.RED+' | Request PoC |') print(color.RED+' +-----------------+\n') print(color.BLUE+' [+] URL : ' +color.CYAN+url) # url part print(color.CYAN+' [+] Name : ' +color.ORANGE+m_name) # name if m_action.count('/') > 1: print(color.GREEN+' [+] Action : ' +color.END+'/'+m_action.rsplit('/', 1)[1]) # action else: print(color.GREEN+' [+] Action : ' +color.END+m_action) # action else: # if value m['name'] not there :( print(color.RED+'\n +-----------------+') print(color.RED+' | Request PoC |') print(color.RED+' +-----------------+\n') print(color.BLUE+' [+] URL : ' +color.CYAN+url) # the url if m_action.count('/') > 1: print(color.GREEN+' [+] Action : ' +color.END+'/'+m_action.rsplit('/', 1)[1]) # action else: print(color.GREEN+' [+] Action : ' +color.END+m_action) # action print(color.ORANGE+' [+] POST Query : '+color.GREY+ urlencode(result).strip()) # If option --skip-poc hasn't been supplied... if POC_GENERATION: # If --malicious has been supplied if GEN_MALICIOUS: # Generates a malicious CSRF form GenMalicious(url, genpoc.__str__()) else: # Generates a normal PoC GenNormalPoC(url, genpoc.__str__()) XSRFProbe-2.3.1/xsrfprobe/modules/Cookie.py000066400000000000000000000174521361432001300205360ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import time, os, sys from re import search, I from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.request import Get from xsrfprobe.core.randua import RandomAgent from xsrfprobe.modules.Persistence import Persistence from xsrfprobe.core.logger import VulnLogger, NovulLogger from urllib.parse import urlencode, unquote, urlsplit resps = [] def SameSite(url): ''' This function parses and verifies the cookies with SameSite Flags. ''' verbout(color.RED, '\n +------------------------------------+') verbout(color.RED, ' | Cross Origin Cookie Validation |') verbout(color.RED, ' +------------------------------------+\n') # Some Flags we'd need later... foundx1 = 0x00 foundx2 = 0x00 foundx3 = 0x00 # Step 1: First we check that if the server returns any # SameSite flag on Cookies with the same Referer as the netloc verbout(color.GREY,' [+] Lets examine how server reacts to same referer...') gen_headers = HEADER_VALUES gen_headers['User-Agent'] = USER_AGENT if USER_AGENT else RandomAgent() verbout(GR,'Setting Referer header same as host...') # Setting the netloc as the referer for the first check. gen_headers['Referer'] = urlsplit(url).netloc if COOKIE_VALUE: gen_headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) getreq = Get(url, headers=gen_headers) # Making the request map(HEADER_VALUES.pop, ['Referer', 'Cookie']) head = getreq.headers for h in head: #if search('cookie', h, I) or search('set-cookie', h, I): if 'Cookie'.lower() in h.lower(): verbout(G,'Found cookie header value...') cookieval = head[h] verbout(color.ORANGE,' [+] Cookie Received: '+color.CYAN+str(cookieval)) m = cookieval.split(';') verbout(GR,'Examining Cookie...') for q in m: if search('SameSite', q, I): verbout(G,'SameSite Flag '+color.ORANGE+' detected on cookie!') foundx1 = 0x01 q = q.split('=')[1].strip() verbout(C, 'Cookie: '+color.ORANGE+q) break else: foundx3 = 0x02 if foundx1 == 0x01: verbout(R,' [+] Endpoint '+color.ORANGE+'SameSite Flag Cookie Validation'+color.END+' Present!') # Step 2: Now we check security mechanisms when the Referer is # different, i.e. request originates from a different url other # than the host. (This time without the Cookie assigned) verbout(color.GREY,' [+] Lets examine how server reacts to a fake external referer...') gen_headers = HEADER_VALUES gen_headers['User-Agent'] = USER_AGENT if USER_AGENT else RandomAgent() # Setting user-agents # Assigning a fake referer for the second check, but no cookie. gen_headers['Referer'] = REFERER_URL gen_headers.pop('Cookie', None) getreq = Get(url, headers=gen_headers) HEADER_VALUES.pop('Referer', None) head = getreq.headers # Getting headers from requests for h in head: # If search('cookie', h, I) or search('set-cookie', h, I): if 'Cookie'.lower() in h.lower(): verbout(G,'Found cookie header value...') cookieval = head[h] verbout(color.ORANGE,' [+] Cookie Received: '+color.CYAN+str(cookieval)) m = cookieval.split(';') verbout(GR,'Examining Cookie...') for q in m: if search('SameSite', q, I): verbout(G,'SameSite Flag '+color.ORANGE+' detected on cookie!') foundx2 = 0x01 q = q.split('=')[1].strip() verbout(C, 'Cookie: '+color.ORANGE+q) break else: foundx3 = 0x02 if foundx1 == 0x01: verbout(R,' [+] Endpoint '+color.ORANGE+'SameSite Flag Cookie Validation'+color.END+' Present!') # Step 3: And finally comes the most important step. Lets see how # the site reacts to a valid cookie (ofc supplied by the user) coming # from a a different site, i.e Referer set to other than host. # This is the most crucial part of the detection. # # TODO: Improve the logic in detection. verbout(color.GREY,' [+] Lets examine how server reacts to valid cookie from a different referer...') gen_headers = HEADER_VALUES gen_headers['User-Agent'] = USER_AGENT or RandomAgent() # Assigning a fake referer for third request, this time with cookie ;) gen_headers['Referer'] = REFERER_URL if COOKIE_VALUE: gen_headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) getreq = Get(url, headers=gen_headers) HEADER_VALUES.pop('Referer', None) head = getreq.headers for h in head: # if search('cookie', h, I) or search('set-cookie', h, I): if 'Cookie'.lower() in h.lower(): verbout(G,'Found cookie header value...') cookieval = head[h] verbout(color.ORANGE,' [+] Cookie Received: '+color.CYAN+str(cookieval)) m = cookieval.split(';') verbout(GR,'Examining Cookie...') for q in m: if search('samesite', q.lower(), I): verbout(G,'SameSite Flag '+color.ORANGE+' detected on cookie on Cross Origin Request!') foundx3 = 0x01 q = q.split('=')[1].strip() verbout(C, 'Cookie: '+color.ORANGE+q) break else: foundx3 = 0x02 if foundx1 == 0x01: verbout(R,'Endpoint '+color.ORANGE+'SameSite Flag Cookie Validation'+color.END+' is Present!') if (foundx1 == 0x01 and foundx3 == 0x00) and (foundx2 == 0x00 or foundx2 == 0x01): print(color.GREEN+' [+] Endpoint '+color.BG+' NOT VULNERABLE to ANY type of CSRF attacks! '+color.END) print(color.GREEN+' [+] Protection Method Detected : '+color.BG+' SameSite Flag on Cookies '+color.END) NovulLogger(url, 'SameSite Flag set on Cookies on Cross-Origin Requests.') # If a SameSite flag is set on cookies, then the application is totally fool-proof # against CSRF attacks unless there is some XSS stuff on it. So for now the job of # this application is done. We need to confirm before we quit. oq = input(color.BLUE+' [+] Continue scanning? (y/N) :> ') if oq.lower().startswith('n'): sys.exit('\n'+R+'Shutting down XSRFProbe...\n') elif foundx1 == 0x02 and foundx2 == 0x02 and foundx3 == 0x02: print(color.GREEN+' [+] Endpoint '+color.BG+' NOT VULNERABLE '+color.END+color.GREEN+' to CSRF attacks!') print(color.GREEN+' [+] Type: '+color.BG+' No Cookie Set while Cross Origin Requests '+color.END) NovulLogger(url, 'No cookie set on Cross-Origin Requests.') else: verbout(R,'Endpoint '+color.ORANGE+'Cross Origin Cookie Validation'+color.END+' Not Present!') verbout(R,'Heuristic(s) reveal endpoint might be '+color.BY+' VULNERABLE '+color.END+' to CSRFs...') print(color.CYAN+ ' [+] Possible CSRF Vulnerability Detected : '+color.GREY+url+'!') print(color.ORANGE+' [!] Possible Vulnerability Type: '+color.BY+' No Cross Origin Cookie Validation Presence '+color.END) VulnLogger(url, 'No Cookie Validation on Cross-Origin Requests.', '[i] Headers: '+str(head)) def Cookie(url, request): ''' This module is for checking the varied HTTP Cookies and the related security on them to prevent CSRF attacks. ''' verbout(GR, 'Proceeding for cookie based checks...') SameSite(url) Persistence(url, request)XSRFProbe-2.3.1/xsrfprobe/modules/Crawler.py000066400000000000000000000127171361432001300207230ustar00rootroot00000000000000#!/usr/bin/env python3 #-*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# #Author: 0xInfection #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbe import re, sys import urllib.error from bs4 import BeautifulSoup from xsrfprobe.modules import Parser from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.files.dcodelist import * from xsrfprobe.core.request import Get from xsrfprobe.core.verbout import verbout from xsrfprobe.core.logger import ErrorLogger from xsrfprobe.files.discovered import INTERNAL_URLS class Handler(): # Main Crawler Handler ''' This is a crawler that is used to fetch all the Urls associated to the HTML page, and susequently crawl them and build checks for CSRFs. ''' def __init__(self, start, opener): self.visited = [] # Visited stuff self.toVisit = [] # To visit self.uriPatterns = [] # Patterns to follow self.currentURI = '' # What is it now? self.opener = opener # Init build_opener self.toVisit.append(start) # Lets add up urls def __next__(self): self.currentURI = self.toVisit[0] # To visit self.toVisit.remove(self.currentURI) # After its done return self.currentURI def getVisited(self): return self.visited def getToVisit(self): return self.toVisit def noinit(self): if self.toVisit: # Incase there are urls left return True # +1 return False # -1 def addToVisit(self, Parser): self.toVisit.append(Parser) # Add what we have got def process(self, root): # Our first task is to remove urls that aren't to be scanned and have been # passed via the --exclude parameter. if EXCLUDE_DIRS: for link in EXCLUDE_DIRS: self.toVisit.remove(link) url = self.currentURI # Main Url (Current) try: query = Get(url) # Open it (to check if it exists) if query != None and not str(query.status_code).startswith('40'): # Avoiding 40x errors INTERNAL_URLS.append(url) # We append it to the list of valid urls else: if url in self.toVisit: self.toVisit.remove(url) except (urllib.error.HTTPError, urllib.error.URLError) as msg: # Incase there isan exception connecting to Url verbout(R, 'HTTP Request Error: '+msg.__str__()) ErrorLogger(url, msg.__str__()) if url in self.toVisit: self.toVisit.remove(url) # Remove non-existent / errored urls return None # Making sure the content type is in HTML format, so that BeautifulSoup # can parse it... if not query or not re.search('html', query.headers['Content-Type']): return None # Just in case there is a redirection, we are supposed to follow it :D verbout(GR, 'Making request to new location...') if hasattr(query.headers, 'Location'): url = query.headers['Location'] verbout(O,'Reading response...') response = query.content # Read the response contents try: verbout(O, 'Trying to parse response...') soup = BeautifulSoup(response) # Parser init except HTMLParser.HTMLParseError: verbout(R, 'BeautifulSoup Error: '+url) self.visited.append(url) if url in self.toVisit: self.toVisit.remove(url) return None for m in soup.findAll('a', href=True): # find out all href^?://* app = '' # Making sure that href is not a function or doesn't begin with http:// if not re.match(r'javascript:', m['href']) or re.match('http://', m['href']): app = Parser.buildUrl(url, m['href']) # If we get a valid link if app!='' and re.search(root, app): # Getting rid of Urls starting with '../../../..' while re.search(RID_DOUBLE, app): p = re.compile(RID_COMPILE) app = p.sub('/', app) # Getting rid of Urls starting with './' p = re.compile(RID_SINGLE) app = p.sub('', app) # Add new link to the queue only if its pattern has not been added yet uriPattern=removeIDs(app) # remove IDs if self.notExist(uriPattern) and app != url: verbout(G, 'Added :> ' +color.BLUE+ app) # display what we have got! self.toVisit.append(app) # add up urls to visit self.uriPatterns.append(uriPattern) self.visited.append(url) # add urls visited return soup # go back! def getUriPatterns(self): # get uri patterns return self.uriPatterns def notExist(self, test): # 404 stuffs if (test not in self.uriPatterns): # if non-existent return 1 return 0 # else existent def addUriPatterns(self, Parser): # append patterns to follow self.uriPatterns.append(Parser) def addVisited(self, Parser): # visited stuffs added self.visited.append(Parser) def removeIDs(Parser): ''' This function removes the Numbers from the Urls which are built. ''' p = re.compile(NUM_SUB) Parser = p.sub('=', Parser) p = re.compile(NUM_COM) Parser = p.sub('\\1', Parser) return Parser XSRFProbe-2.3.1/xsrfprobe/modules/Debugger.py000066400000000000000000000152601361432001300210440ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import re import string from xsrfprobe.core.colors import * from random import Random from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout class Form_Debugger(): def prepareFormInputs(self, form): ''' This method parses form types and generates strings based on their input types. ''' verbout(O,'Crafting inputs as form type...') cr_input = {} totcr = [] verbout(GR, 'Processing '+color.BOLD+'= max_length: print(color.ORANGE+' [+] CSRF Token Length greater than '+color.CYAN+'256 bytes. '+color.GREEN+'Token value cannot be guessed/bruteforced...') print(color.GREEN+' [+] Endpoint likely '+color.BG+' NOT VULNERABLE '+color.END+color.GREEN+' to CSRF Attacks...') print(color.GREEN+' [!] CSRF Mitigation Method: '+color.BG+' Long Anti-CSRF Tokens '+color.END) NovulLogger(url, 'Long Anti-CSRF tokens with Good Strength.') found = 0x01 # Checking entropy verbout(O, 'Proceeding to calculate '+color.GREY+'Shannon Entropy'+color.END+' of Token audited...') entropy = calcEntropy(value) verbout(GR, 'Calculating Entropy...') verbout(color.BLUE, ' [+] Entropy Calculated: '+color.CYAN+str(entropy)) if entropy >= min_entropy: verbout(color.ORANGE,' [+] Anti-CSRF Token Entropy Calculated is '+color.BY+' GREATER than 3.0 '+color.END+'... ') print(color.ORANGE+' [+] Endpoint '+color.BY+' PROBABLY NOT VULNERABLE '+color.END+color.ORANGE+' to CSRF Attacks...') print(color.ORANGE+' [!] CSRF Mitigation Method: '+color.BY+' High Entropy Anti-CSRF Tokens '+color.END) NovulLogger(url, 'High Entropy Anti-CSRF Tokens.') found = 0x01 else: verbout(color.RED,' [-] Anti-CSRF Token Entropy Calculated is '+color.BY+' LESS than 3.0 '+color.END+'... ') print(color.RED+' [-] Endpoint likely '+color.BR+' VULNERABLE '+color.END+color.RED+' to CSRF Attacks inspite of CSRF Tokens...') print(color.RED+' [!] Vulnerability Type: '+color.BR+' Low Entropy Anti-CSRF Tokens '+color.END) VulnLogger(url, 'Low Entropy Anti-CSRF Tokens.', 'Token: '+value) if found == 0x00: if m_name: print(color.RED+'\n +---------+') print(color.RED+' | PoC |') print(color.RED+' +---------+\n') print(color.BLUE+' [+] URL : ' +color.CYAN+url) print(color.CYAN+' [+] Name : ' +color.ORANGE+m_name) print(color.GREEN+' [+] Action : ' +color.ORANGE+m_action) else: # if value m_name not there :( print(color.RED+'\n +---------+') print(color.RED+' | PoC |') print(color.RED+' +---------+\n') print(color.BLUE+' [+] URL : ' +color.CYAN+url) print(color.GREEN+' [+] Action : ' +color.ORANGE+m_action) # Print out the params print(color.ORANGE+' [+] Query : '+color.GREY+urllib.parse.urlencode(req)) print('') return (_q, para) # Return the query paramter and anti-csrf token def calcEntropy(data): """ This function is used to calculate Shannon Entropy. """ if not data: return 0 entropy = 0 # init for x in range(256): p_x = float(data.count(chr(x)))/len(data) if p_x > 0: entropy += - p_x * log(p_x, 2) return entropy XSRFProbe-2.3.1/xsrfprobe/modules/Generator.py000066400000000000000000000107261361432001300212500ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe from ast import literal_eval from bs4 import BeautifulSoup from yattag import Doc, indent from xsrfprobe.core.colors import * from xsrfprobe.core.verbout import verbout from xsrfprobe.files.config import OUTPUT_DIR from xsrfprobe.core.prettify import formPrettify from xsrfprobe.core.prettify import indentPrettify doc, tag, text = Doc().tagtext() def GenNormalPoC(action, fields, method='POST', encoding_type='application/x-www-form-urlencoded'): """ Generate a normal CSRF PoC using basic form data """ print(GR+'Generating normal PoC Form...' ) verbout(color.RED, '\n +---------------------+') verbout(color.RED, ' | Normal Form PoC |') verbout(color.RED, ' +---------------------+\n'+color.CYAN) # Main starting which we will use to generate form. with tag('html'): with tag('title'): text('CSRF PoC') with tag('body'): with tag('h2'): text('Your CSRF PoC') # Try not messing with this part. (1) with tag('form', id='xsrfprobe_csrfpoc', action=action, enctype=encoding_type, method="POST"): for field in literal_eval(fields): with tag('label'): text(field['label'].title()) doc.input(name=field['name'], type=field['type'], value=field['value']) # Adding the Submit Button doc.stag('input', value='Submit', type='submit') doc.stag('br') # Brand tag :p ...I guess... with tag('small'): text('(o) This form was generated by ') with tag('a', href='https://github.com/0xInfection/xsrfprobe'): text('XSRFProbe') text('.') content = BeautifulSoup(doc.getvalue(), 'html.parser') formPrettify(indentPrettify(content)) print('') # Write out the file af... if '//' in action: splitterfunc = action.split('//', 1)[1].replace('/','-') else: splitterfunc = action.replace('/', '-') fi = open(OUTPUT_DIR+splitterfunc+'-csrf-poc.html', 'w+', encoding='utf-8') fi.write(content.prettify()) fi.close() print(G+'PoC successfully saved under '+color.ORANGE+OUTPUT_DIR+splitterfunc+'-csrf-poc.html') def GenMalicious(action, fields, method='POST', encoding_type='application/x-www-form-urlencoded'): """ Generate a malicious CSRF PoC using basic form data """ print(GR, 'Generating malicious PoC Form...' ) verbout(color.RED, '\n +------------------------+') verbout(color.RED, ' | Malicious Form PoC |') verbout(color.RED, ' +------------------------+\n'+color.CYAN) # Main starting which we will use to generate form. with tag('html'): with tag('title'): text('CSRF PoC') with tag('body'): with tag('script'): doc.asis('alert("You have been pwned!!!")') # Try not messing with this part. (1) with tag('form', id='xsrfprobe_csrfpoc', action=action, enctype=encoding_type, method="POST"): for field in literal_eval(fields): if not field['value']: val = input(C+'Enter value for form field '+color.GREEN+field['name'].title()+' :> '+color.CYAN) doc.input(name=field['name'], type='hidden', value=val) # The idea behind this is to generate PoC forms not requiring any # user interaction. As soon as the page loads, the form with submit automatically. with tag('script'): # Try not messing with this part. (2) doc.asis('document.getElementById("xsrfprobe_csrfpoc").submit();') # Brand tag :p ...I guess... doc.asis('') content = BeautifulSoup(doc.getvalue(), 'html.parser') formPrettify(indentPrettify(content)) print('') # Write out the file af... if '//' in action: splitterfunc = action.split('//', 1)[1].replace('/','-') else: splitterfunc = action.replace('/', '-') fi = open(OUTPUT_DIR+splitterfunc+'-csrf-poc.html', 'w+', encoding='utf-8') fi.write(content.prettify()) fi.close() print(G+'PoC successfully saved under '+color.ORANGE+OUTPUT_DIR+splitterfunc+'-malicious-poc.html') XSRFProbe-2.3.1/xsrfprobe/modules/Origin.py000066400000000000000000000064531361432001300205530ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import requests from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.request import Get from xsrfprobe.core.randua import RandomAgent from xsrfprobe.core.logger import VulnLogger, NovulLogger def Origin(url): """ Check if the remote web application verifies the Origin before processing the HTTP request. """ verbout(color.RED, '\n +-------------------------------------+') verbout(color.RED, ' | Origin Based Request Validation |') verbout(color.RED, ' +-------------------------------------+\n') # Make the request normally and get content verbout(O,'Making request on normal basis...') req0x01 = Get(url) global HEADER_VALUES # Set a fake Origin along with UA (pretending to be a # legitimate request from a browser) verbout(GR,'Setting generic headers...') gen_headers = HEADER_VALUES gen_headers['Origin'] = ORIGIN_URL # We put the cookie in request, if cookie supplied :D if COOKIE_VALUE: gen_headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) # Make the request with different Origin header and get the content verbout(O,'Making request with '+color.CYAN+'Tampered Origin Header'+color.END+'...') req0x02 = Get(url, headers=gen_headers) HEADER_VALUES.pop('Origin', None) # Comparing the length of the requests' responses. If both content # lengths are same, then the site actually does not validate Origin # before processing the HTTP request which makes the site more # vulnerable to CSRF attacks. # # IMPORTANT NOTE: I'm aware that checking for the Origin header does # NOT protect the application against all cases of CSRF, but it's a # very good first step. In order to exploit a CSRF in an application # that protects using this method an intruder would have to identify # other vulnerabilities, such as XSS or open redirects, in the same # domain. # # TODO: This algorithm has lots of room for improvement if len(req0x01.content) != len(req0x02.content): verbout(color.GREEN,' [+] Endoint '+color.ORANGE+'Origin Validation'+color.GREEN+' Present!') print(color.GREEN+' [-] Heuristics reveal endpoint might be '+color.BG+' NOT VULNERABLE '+color.END+'...') print(color.ORANGE+' [+] Mitigation Method: '+color.BG+' Origin Based Request Validation '+color.END+'\n') NovulLogger(url, 'Presence of Origin Header based request Validation.') return True else: verbout(R,'Endpoint '+color.RED+'Origin Validation Not Present'+color.END+'!') verbout(R,'Heuristics reveal endpoint might be '+color.BY+' VULNERABLE '+color.END+' to Origin Based CSRFs...') print(color.CYAN+ ' [+] Possible CSRF Vulnerability Detected : '+color.GREY+url+'!') print(color.ORANGE+' [!] Possible Vulnerability Type: '+color.BY+' No Origin Based Request Validation '+color.END+'\n') VulnLogger(url, 'No Origin Header based request validation presence.', '[i] Response Headers: '+str(req0x02.headers)) return False XSRFProbe-2.3.1/xsrfprobe/modules/Parser.py000066400000000000000000000053241361432001300205540ustar00rootroot00000000000000#!/usr/bin/env python3 #-*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# #Author: 0xInfection #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbe import re from urllib.parse import urlsplit from xsrfprobe.core.verbout import verbout from xsrfprobe.files.dcodelist import PROTOCOLS from xsrfprobe.files.paramlist import EXCLUSIONS_LIST from xsrfprobe.core.colors import * # import ends def buildUrl(url, href): # receive form input type / url ''' This function is for building a proper URL based on comparison to 'href'. ''' # Making an exclusion list, so as to stop detection of Self-CSRF (Logout-CSRF) # # This is yet another step is reducing false positives [[ significantly ]]. # Self-CSRF/Logout Based CSRFs are not really of any value and are deemed # of as low quality CSRF (bugs). # # TODO: Add more to EXCLUSIONS_LIST. if href == "http://localhost" or any((re.search(s, href, re.IGNORECASE)) for s in EXCLUSIONS_LIST): return None url_parts = urlsplit(url) # SplitResult(scheme, netloc, path, query, fragment) href_parts = urlsplit(href) app = '' # Init to the Url that will be built # If Url and Destination have the same domain... if href_parts.netloc == url_parts.netloc: app = href # Assigning the main netloc else: # If the destination Url doesn't have a domain if len(href_parts.netloc) == 0 and (len(href_parts.path) != 0 or len(href_parts.query) != 0): domain = url_parts.netloc # Assigning the main domain if href_parts.path.startswith('/'): # If the href starts with a '/', it is an internal Url app = url_parts.scheme + '://' + domain + href_parts.path # Startpage else: try: app = 'http://' + domain + re.findall(PROTOCOLS, url_parts.path)[0] + href_parts.path # Get real protocol urls except IndexError: app = 'http://' + domain + href_parts.path if href_parts.query: # Checking if any queries were there... app += '?' + href_parts.query # Adding the query paramaters to Url # Return '' for invalid url, url otherwise return app def buildAction(url, action): ''' The main function of this is to create an action Url based on Current Location and Destination. ''' verbout(O,'Parsing URL parameters...') if action and not action.startswith('#'): # make sure it is not a fragment (eg. http://site.tld/index.php#search) return buildUrl(url, action) # get the url and reutrn it! return url # return the url itself if buildAction didn't identify the action XSRFProbe-2.3.1/xsrfprobe/modules/Persistence.py000066400000000000000000000166761361432001300216200ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import time, os, sys from re import search, I from datetime import datetime from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.request import Get from xsrfprobe.core.randua import RandomAgent from xsrfprobe.core.utils import checkDuplicates from xsrfprobe.core.logger import VulnLogger, NovulLogger from urllib.parse import urlencode, unquote, urlsplit # Response storing list init resps = [] def Persistence(url, postq): ''' The main idea behind this is to check for Cookie Persistence. ''' verbout(color.RED, '\n +-----------------------------------+') verbout(color.RED, ' | Cookie Persistence Validation |') verbout(color.RED, ' +-----------------------------------+\n') # Checking if user has supplied a value. verbout(GR,'Proceeding to test for '+color.GREY+'Cookie Persistence'+color.END+'...') time.sleep(0.7) found = 0x00 # Now let the real test begin... # # [Step 1]: Lets examine now whether cookies set by server are persistent or not. # For this we'll have to parse the cookies set by the server and check for the # time when the cookie expires. Lets do it! # # First its time for GET type requests. Lets prepare our request. cookies = [] verbout(C, 'Proceeding to test cookie persistence via '+color.CYAN+'Prepared GET Requests'+color.END+'...') verbout(GR,'Making the request...') req = Get(url, headers=HEADER_VALUES) if req.cookies: for cook in req.cookies: if cook.expires: print(color.GREEN+' [+] Persistent Cookies found in Response Headers!') print(color.GREY+' [+] Cookie: '+color.CYAN+cook.__str__()) # cookie.expires returns a timestamp value. I didn't know it. :( Spent over 2+ hours scratching my head # over this, until I stumbled upon a stackoverflow answer comment. So to decode this, we'd need to # convert it a human readable format. print(color.GREEN+' [+] Cookie Expiry Period: '+color.ORANGE+datetime.fromtimestamp(cook.expires).__str__()) found = 0x01 VulnLogger(url, 'Persistent Session Cookies Found.', '[i] Cookie: '+req.headers.get('Set-Cookie')) else: NovulLogger(url, 'No Persistent Session Cookies.') if found == 0x00: verbout(R, 'No persistent session cookies identified on GET Type Requests!') verbout(C, 'Proceeding to test cookie persistence on '+color.CYAN+'POST Requests'+color.END+'...') # Now its time for POST Based requests. # # NOTE: As a standard method, every web application should supply a cookie upon a POST query. # It might or might not be in case of GET requests. if postq.cookies: for cookie in postq.cookies: if cookie.expires: print(color.GREEN+' [+] Persistent Cookies found in Response Headers!') print(color.GREY+' [+] Cookie: '+color.CYAN+cookie.__str__()) # So to decode this, we'd need to convert it a human readable format. print(color.GREEN+' [+] Cookie Expiry Period: '+color.ORANGE+datetime.fromtimestamp(cookie.expires).__str__()) found = 0x01 VulnLogger(url, 'Persistent Session Cookies Found.', '[i] Cookie: '+req.headers.get('Set-Cookie')) print(color.ORANGE+' [!] Probable Insecure Practice: '+color.BY+' Persistent Session Cookies '+color.END) else: NovulLogger(url, 'No Persistent Cookies.') if found == 0x00: verbout(R, 'No persistent session cookies identified upon POST Requests!') print(color.ORANGE+' [+] Endpoint might be '+color.BY+' NOT VULNERABLE '+color.END+color.ORANGE+' to CSRF attacks!') print(color.ORANGE+' [+] Detected : '+color.BY+' No Persistent Cookies '+color.END) # [Step 2]: The idea here is to try to identify cookie persistence on basis of observing # variations in cases of using different user-agents. For this test we have chosen 5 different # well used and common user-agents (as below) and then we observe the variation of set-cookie # header under different conditions. # # We'll test this method only when we haven't identified requests based on previous algo. if found != 0x01: verbout(C, 'Proceeding to test cookie persistence via '+color.CYAN+'User-Agent Alteration'+color.END+'...') user_agents = { 'Chrome on Windows 8.1' : 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36', 'Safari on iOS' : 'Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B466 Safari/600.1.4', 'IE6 on Windows XP' : 'Mozilla/5.0 (Windows; U; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)', 'Opera on Windows 10' : 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 OPR/43.0.2442.991', 'Chrome on Android' : 'Mozilla/5.0 (Linux; U; Android 2.3.1; en-us; MID Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1' } verbout(GR,'Setting custom generic headers...') gen_headers = HEADER_VALUES for name, agent in user_agents.items(): verbout(C, 'Using User-Agent : '+color.CYAN+name) verbout(GR, 'Value : '+color.ORANGE+agent) gen_headers['User-Agent'] = agent if COOKIE_VALUE: gen_headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) req = Get(url, headers=gen_headers) # We will append this to stuff only when set-cookie is being supplied. if req.headers.get('Set-Cookie'): resps.append(req.headers.get('Set-Cookie')) HEADER_VALUES.pop('User-Agent', None) HEADER_VALUES['User-Agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36' if resps: if checkDuplicates(resps): verbout(G, 'Set-Cookie header does not change with varied User-Agents...') verbout(color.ORANGE, ' [+] Possible persistent session cookies found...') print(color.RED+' [+] Possible CSRF Vulnerability Detected : '+color.ORANGE+url+'!') print(color.ORANGE+' [!] Probable Insecure Practice: '+color.BY+' Persistent Session Cookies '+color.END) VulnLogger(url, 'Persistent Session Cookies Found.', '[i] Cookie: '+req.headers.get('Set-Cookie')) else: verbout(G, 'Set-Cookie header changes with varied User-Agents...') verbout(R, 'No possible persistent session cookies found...') verbout(color.ORANGE, ' [+] Endpoint '+color.BY+' PROBABLY NOT VULNERABLE '+color.END+color.ORANGE+' to CSRF attacks!') verbout(color.ORANGE, ' [+] Application Practice Method Detected : '+color.BY+' No Persistent Cookies '+color.END) NovulLogger(url, 'No Persistent Cookies.') else: verbout(R, 'No cookies are being set on any requests.')XSRFProbe-2.3.1/xsrfprobe/modules/Referer.py000066400000000000000000000064121361432001300207110ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe import requests from xsrfprobe.core.colors import * from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.request import Get from xsrfprobe.core.logger import VulnLogger, NovulLogger def Referer(url): """ Check if the remote web application verifies the Referer before processing the HTTP request. """ verbout(color.RED, '\n +--------------------------------------+') verbout(color.RED, ' | Referer Based Request Validation |') verbout(color.RED, ' +--------------------------------------+\n') # Make the request normally and get content verbout(O,'Making request on normal basis...') req0x01 = Get(url) # Set normal headers... verbout(GR,'Setting generic headers...') gen_headers = HEADER_VALUES # Set a fake Referer along with UA (pretending to be a # legitimate request from a browser) gen_headers['Referer'] = REFERER_URL # We put the cookie in request, if cookie supplied :D if COOKIE_VALUE: gen_headers['Cookie'] = ','.join(cookie for cookie in COOKIE_VALUE) # Make the request with different referer header and get the content verbout(O,'Making request with '+color.CYAN+'Tampered Referer Header'+color.END+'...') req0x02 = Get(url, headers=gen_headers) HEADER_VALUES.pop('Referer', None) # Comparing the length of the requests' responses. If both content # lengths are same, then the site actually does not validate referer # before processing the HTTP request which makes the site more # vulnerable to CSRF attacks. # # IMPORTANT NOTE: I'm aware that checking for the referer header does # NOT protect the application against all cases of CSRF, but it's a # very good first step. In order to exploit a CSRF in an application # that protects using this method an intruder would have to identify # other vulnerabilities, such as XSS or open redirects, in the same # domain. # # TODO: This algorithm has lots of room for improvement. if len(req0x01.content) != len(req0x02.content): print(color.GREEN+' [+] Endoint '+color.ORANGE+'Referer Validation'+color.GREEN+' Present!') print(color.GREEN+' [-] Heuristics reveal endpoint might be '+color.BG+' NOT VULNERABLE '+color.END+'...') print(color.ORANGE+' [+] Mitigation Method: '+color.BG+' Referer Based Request Validation '+color.END) NovulLogger(url, 'Presence of Referer Header based Request Validation.') return True else: verbout(R,'Endpoint '+color.RED+'Referer Validation Not Present'+color.END+'!') verbout(R,'Heuristics reveal endpoint might be '+color.BY+' VULNERABLE '+color.END+' to Origin Based CSRFs...') print(color.CYAN+ ' [+] Possible CSRF Vulnerability Detected : '+color.GREY+url+'!') print(color.ORANGE+' [+] Possible Vulnerability Type: '+color.BY+' No Referer Based Request Validation '+color.END) VulnLogger(url, 'No Referer Header based Request Validation presence.', '[i] Response Headers: '+str(req0x02.headers)) return False XSRFProbe-2.3.1/xsrfprobe/modules/Tamper.py000066400000000000000000000163701361432001300205530ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-:-:-:# # XSRFProbe # #-:-:-:-:-:-:-:-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe from re import search, I from urllib.parse import urlencode, quote from xsrfprobe.core.colors import * from xsrfprobe.core.request import Post from xsrfprobe.files.config import * from xsrfprobe.core.verbout import verbout from xsrfprobe.core.utils import replaceStrIndex from xsrfprobe.files.paramlist import TOKEN_ERRORS from xsrfprobe.core.logger import VulnLogger, NovulLogger def Tamper(url, action, req, body, query, para): ''' The main idea behind this is to tamper the Anti-CSRF tokens found and check the content length for related vulnerabilities. ''' verbout(color.RED, '\n +---------------------------------------+') verbout(color.RED, ' | Anti-CSRF Token Tamper Validation |') verbout(color.RED, ' +---------------------------------------+\n') # Null char flags (hex) flagx1, destx1 = 0x00, 0x00 flagx2, destx2 = 0x00, 0x00 flagx3, destx3 = 0x00, 0x00 verbout(GR, 'Proceeding for CSRF attack via Anti-CSRF token tampering...') # First of all lets get out token from request if para == '': return True # Coverting the token to a raw string, cause some special # chars might fu*k with the operation. value = r'%s' % para copy = req # Alright lets start... # [Step 1]: First we take the token and then replace a particular character # at a specific position (here at 4th position) and test the response body. # # Required check for checking if string at that position isn't the # same char we are going to replace with. verbout(GR, 'Tampering Token by '+color.GREY+'index replacement'+color.END+'...') if value[3] != 'a': tampvalx1 = replaceStrIndex(value, 3, 'a') else: tampvalx1 = replaceStrIndex(value, 3, 'x') verbout(color.BLUE, ' [+] Original Token: '+color.CYAN+value) verbout(color.BLUE, ' [+] Tampered Token: '+color.CYAN+tampvalx1) # Lets build up the request... req[query] = tampvalx1 resp = Post(url, action, req) # If there is a 40x (Not Found) or a 50x (Internal Error) error, # we assume that the tamper did not work :( But if there is a 20x # (Accepted) or a 30x (Redirection), then we know it worked. # # Or if the previous request has same content length as this tampered # request, then we have the vulnerability. # # NOTE: This algorithm has lots of room for improvement. if str(resp.status_code).startswith('2'): destx1 = 0x01 if not any(search(s, resp.text, I) for s in TOKEN_ERRORS): destx2 = 0x01 if len(body) == len(resp.text): destx3 = 0x01 if ((destx1 == 0x01 and destx2 == 0x01) or (destx3 == 0x01)): verbout(color.RED,' [-] Anti-CSRF Token tamper by '+color.GREY+'index replacement'+color.RED+' returns valid response!') flagx1 = 0x01 VulnLogger(url, 'Anti-CSRF Token tamper by index replacement returns valid response.', '[i] POST Query: '+req.__str__()) else: verbout(color.RED,' [+] Token tamper in request does not return valid response!') NovulLogger(url, 'Anti-CSRF Token tamper by index replacement does not return valid response.') # [Step 2]: Second we take the token and then remove a character # at a specific position and test the response body. verbout(GR, 'Tampering Token by '+color.GREY+'index removal'+color.END+'...') tampvalx2 = replaceStrIndex(value, 3) verbout(color.BLUE, ' [+] Original Token: '+color.CYAN+value) verbout(color.BLUE, ' [+] Tampered Token: '+color.CYAN+tampvalx2) # Lets build up the request... req[query] = tampvalx2 resp = Post(url, action, req) # If there is a 40x (Not Found) or a 50x (Internal Error) error, # we assume that the tamper did not work :( But if there is a 20x # (Accepted) or a 30x (Redirection), then we know it worked. # # NOTE: This algorithm has lots of room for improvement. if str(resp.status_code).startswith('2'): destx1 = 0x02 if not any(search(s, resp.text, I) for s in TOKEN_ERRORS): destx2 = 0x02 if len(body) == len(resp.text): destx3 = 0x02 if ((destx1 == 0x02 and destx2 == 0x02) or destx3 == 0x02): verbout(color.RED,' [-] Anti-CSRF Token tamper by '+color.GREY+'index removal'+color.RED+' returns valid response!') flagx2 = 0x01 VulnLogger(url, 'Anti-CSRF Token tamper by index removal returns valid response.', '[i] POST Query: '+req.__str__()) else: verbout(color.RED,' [+] Token tamper in request does not return valid response!') NovulLogger(url, 'Anti-CSRF Token tamper by index removal does not return valid response.') # [Step 3]: Third we take the token and then remove the whole # anticsrf token and test the response body. verbout(GR, 'Tampering Token by '+color.GREY+'Token removal'+color.END+'...') # Removing the anti-csrf token from request del req[query] verbout(color.GREY, ' [+] Removed token parameter from request!') # Lets build up the request... resp = Post(url, action, req) # If there is a 40x (Not Found) or a 50x (Internal Error) error, # we assume that the tamper did not work :(. But if there is a 20x # (Accepted) or a 30x (Redirection), then we know it worked. # # NOTE: This algorithm has lots of room for improvement. if str(resp.status_code).startswith('2'): destx1 = 0x03 if not any(search(s, resp.text, I) for s in TOKEN_ERRORS): destx2 = 0x03 if len(body) == len(resp.text): destx3 = 0x03 if ((destx1 == 0x03 and destx2 == 0x03) or destx3 == 0x03): verbout(color.RED,' [-] Anti-CSRF'+color.GREY+' Token removal'+color.RED+' returns valid response!') flagx3 = 0x01 VulnLogger(url, 'Anti-CSRF Token removal returns valid response.', '[i] POST Query: '+req.__str__()) else: verbout(color.RED,' [+] Token tamper in request does not return valid response!') NovulLogger(url, 'Anti-CSRF Token removal does not return valid response.') # If any of the forgeries worked... if ((flagx1==0x01 and flagx2==0x01) or (flagx1==0x01 and flagx3==0x01) or (flagx2==0x01 and flagx3==0x01)): verbout(color.RED,' [+] The tampered token value works! Endpoint '+color.BR+' VULNERABLE to Replay Attacks '+color.END+'!') verbout(color.ORANGE,' [-] The Tampered Anti-CSRF Token requested does NOT return a 40x or 50x response! ') print(color.RED+' [-] Endpoint '+color.BR+' CONFIRMED VULNERABLE '+color.END+color.RED+' to Request Forgery Attacks...') print(color.ORANGE+' [!] Vulnerability Type: '+color.BR+' Non-Unique Anti-CSRF Tokens in Requests '+color.END+'\n') VulnLogger(url, 'Anti-CSRF Tokens are not Unique. Token Reuse detected.', '[i] Request: '+str(copy)) return True else: print(color.RED+' [-] The Tampered Anti-CSRF Token requested returns a 40x or 50x response... ') print(color.GREEN+' [-] Endpoint '+color.BG+' NOT VULNERABLE '+color.END+color.ORANGE+' to CSRF Attacks...') print(color.ORANGE+' [!] CSRF Mitigation Method: '+color.BG+' Unique Anti-CSRF Tokens '+color.END+'\n') NovulLogger(url, 'Unique Anti-CSRF Tokens. No token reuse.') return False XSRFProbe-2.3.1/xsrfprobe/modules/Token.py000066400000000000000000000066571361432001300204120ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe from re import search, I from time import sleep from xsrfprobe.files import config from xsrfprobe.core.colors import * from xsrfprobe.core.verbout import verbout from xsrfprobe.files import discovered from urllib.parse import urlencode, unquote from xsrfprobe.files.paramlist import COMMON_CSRF_NAMES, COMMON_CSRF_HEADERS def Token(req, headers): ''' This method checks for whether Anti-CSRF Tokens are present in the request. ''' verbout(color.RED, '\n +---------------------------+') verbout(color.RED, ' | Anti-CSRF Token Check |') verbout(color.RED, ' +---------------------------+\n') param = '' # Initializing param query = '' found = False # First lets have a look at config.py and see if its set if config.TOKEN_CHECKS: verbout(O,'Parsing request for detecting anti-csrf tokens...') try: # Lets check for the request values. But before that lets encode and unquote the request :D con = unquote(urlencode(req)).split('&') for c in con: for name in COMMON_CSRF_NAMES: # Iterate over the list qu = c.split('=') # Search if the token is there in request... if name.lower() in qu[0].lower(): verbout(color.GREEN, ' [+] The form was requested with an '+color.BG+' Anti-CSRF Token '+color.END+color.GREEN+'!') verbout(color.GREY, ' [+] Token Parameter: '+color.CYAN+qu[0]+'='+color.ORANGE+qu[1]) query, param = qu[0], qu[1] # We are appending the token to a variable for further analysis discovered.REQUEST_TOKENS.append(param) found = True break # Break execution if a Anti-CSRF token is found # If we haven't found the Anti-CSRF token in query, we'll search for it in headers :) if not found: for key, value in headers.items(): for name in COMMON_CSRF_HEADERS: # Iterate over the list # Search if the token is there in request... if name.lower() in key.lower(): verbout(color.GREEN, ' [+] The form was requested with an '+color.BG+' Anti-CSRF Token Header '+color.END+color.GREEN+'!') verbout(color.GREY, ' [+] Token Parameter: '+color.CYAN+qu[0]+'='+color.ORANGE+qu[1]) query, param = key, value # We are appending the token to a variable for further analysis discovered.REQUEST_TOKENS.append(param) break # Break execution if a Anti-CSRF token is found except Exception as e: verbout(R, 'Request Parsing Exception!') verbout(R, 'Error: '+e.__str__()) if param: return (query, param) verbout(color.ORANGE,' [-] The form was requested '+color.RED+' Without an Anti-CSRF Token '+color.END+color.ORANGE+'...') print(color.RED+' [-] Endpoint seems '+color.BR+' VULNERABLE '+color.END+color.RED+' to '+color.BR+' POST-Based Request Forgery '+color.END) return (None, None) XSRFProbe-2.3.1/xsrfprobe/modules/__init__.py000066400000000000000000000003221361432001300210500ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection #This module requires XSRFProbe #https://github.com/0xInfection/XSRFProbeXSRFProbe-2.3.1/xsrfprobe/pocs/000077500000000000000000000000001361432001300162365ustar00rootroot00000000000000XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-get-malicious.html000066400000000000000000000003341361432001300226210ustar00rootroot00000000000000 CSRF GET Malicious PoC

CSRF GET PoC (No User Interaction)

By the time you're reading this, the attack has been executed.

XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-get.html000066400000000000000000000002401361432001300206320ustar00rootroot00000000000000 CSRF GET PoC

CSRF GET PoC (Requires User Interaction).

Click Me XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-json-get.html000066400000000000000000000002731361432001300216070ustar00rootroot00000000000000 CSRF JSON GET PoC

JSON GET Based CSRF PoC.

XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-json-post-1.html000066400000000000000000000010521361432001300221470ustar00rootroot00000000000000 CSRF JSON POST PoC

JSON Simple POST Based CSRF PoC.

XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-json-post-2.html000066400000000000000000000005011361432001300221460ustar00rootroot00000000000000 CSRF JSON POST PoC

JSON Complex POST Based CSRF PoC.

XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-post-malicious.html000066400000000000000000000006361361432001300230340ustar00rootroot00000000000000 CSRF POST PoC

POST Based CSRF PoC (No User Interaction)

XSRFProbe-2.3.1/xsrfprobe/pocs/csrf-post.html000066400000000000000000000005451361432001300210500ustar00rootroot00000000000000 CSRF POST PoC

POST Based CSRF PoC (Requires User Interaction)

XSRFProbe-2.3.1/xsrfprobe/xsrfprobe.py000066400000000000000000000005161361432001300176600ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- #-:-:-:-:-:-:-::-:-:# # XSRF Probe # #-:-:-:-:-:-:-::-:-:# # Author: 0xInfection # This module requires XSRFProbe # https://github.com/0xInfection/XSRFProbe def startEngine(): from xsrfprobe.core import main # import stuff main.Engine() # start the Scanner Engine ;)