64 lines
2.2 KiB
Bash
Executable File
64 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 11: Cross-Site Request Forgery
|
|
# Desc: Missing CSRF tokens in state-changing forms
|
|
# Detect: Forms without CSRF tokens, SameSite=None cookies
|
|
# Severity: MEDIUM
|
|
# Tools: curl
|
|
|
|
vector_csrf() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing CSRF vectors..."
|
|
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
|
|
# Find forms
|
|
local forms=$(echo "$page" | perl -nle 'print \$& if /<form[^>]*>/g' 2>/dev/null)
|
|
|
|
if [ -z "$forms" ]; then
|
|
print_skip "No forms found to test"
|
|
return 0
|
|
fi
|
|
|
|
print_info "Found $(echo "$forms" | wc -l | tr -d ' ') form(s), checking CSRF protection..."
|
|
|
|
local form_count=0
|
|
while IFS= read -r form; do
|
|
form_count=$((form_count + 1))
|
|
local form_method=$(echo "$form" | sed -n 's/.*method="\([^"]*\)".*/\1/p' | sed 's/method="//;s/"//' | tr '[:upper:]' '[:lower:]')
|
|
local form_action=$(echo "$form" | sed -n 's/.*action="\([^"]*\)".*/\1/p' | sed 's/action="//;s/"//')
|
|
|
|
# Check for CSRF token in form
|
|
if ! echo "\$form" | grep -qiE 'csrf|_token|nonce|authenticity_token|xsrf|__RequestVerificationToken'; then
|
|
# Check page for hidden CSRF fields
|
|
local hidden_fields=$(echo "$page" | perl -nle 'print \$& if /<input[^>]*hidden[^>]*>/g' 2>/dev/null)
|
|
local has_csrf=false
|
|
|
|
while IFS= read -r hidden; do
|
|
if echo "\$hidden" | grep -qiE 'csrf|_token|nonce|authenticity'; then
|
|
has_csrf=true
|
|
break
|
|
fi
|
|
done <<< "$hidden_fields"
|
|
|
|
if [ "$has_csrf" = false ] && [ "$form_method" = "post" ]; then
|
|
print_find "CSRF vulnerability!" "Form #$form_count missing CSRF protection"
|
|
echo "SEVERITY: MEDIUM
|
|
VECTOR: Cross-Site Request Forgery (CSRF)
|
|
DETAIL: CSRF - No CSRF token in state-changing form on $target
|
|
EVIDENCE: Form action=$form_action, method=$form_method lacks CSRF protection
|
|
EXPLOIT: Generate malicious HTML form that auto-submits to this endpoint" > "$REPORTS_DIR/.finding_$(date +%s)_csrf.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
fi
|
|
done <<< "$forms"
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_ok "All forms appear to have CSRF protection"
|
|
fi
|
|
|
|
return $findings
|
|
}
|