CSRFTester Usage - Revision history

Christina Schelin at 18:07, 12 March 2015

2015-03-12T18:07:17Z

Christina Schelin at 15:51, 10 March 2015

2015-03-10T15:51:55Z

Christina Schelin: Some minor tidying.

2015-03-10T15:51:43Z

Some minor tidying.

Esheridan at 22:18, 26 November 2007

2007-11-26T22:18:34Z

Esheridan at 16:48, 21 November 2007

2007-11-21T16:48:11Z

Esheridan: New page: == Overview == The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment. To download the tool, please visit the...

2007-11-21T16:45:51Z

New page: == Overview == The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment. To download the tool, please visit the...

New page

== Overview ==

The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment. To download the tool, please visit the OWASP CSRFTester project page at https://www.owasp.org/index.php/Category:OWASP_CSRFTester_Project

== Launch OWASP CSRFTester ==

:*'''Update JAVA_HOME''' in run.bat to ensure appropriate access to the JVM.
:*'''Double-click run.bat''' to launch CSRFTester with the appropriate classpath configuration

The CSRFTester distribution contains three files: run.bat, OWASP-CSRFTester-1.0.jar, and concurrent.jar. The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under C:\AppSecWorkbench\jdk16\jre. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and 'CD' directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.

@@ Line 3: / Line 3: @@
 The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment.
-To download the tool, please visit the [[:Category:OWASP_CSRFTester_Project OWASP|CSRFTester project page]].
+To download the tool, please visit the [[:Category:OWASP_CSRFTester_Project|OWASP CSRFTester project page]].
 == Quick Steps ==

@@ Line 3: / Line 3: @@
 The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment.
-To download the tool, please visit the [[:Category:OWASP_CSRFTester_Project OWASP CSRFTester project page]].
+To download the tool, please visit the [[:Category:OWASP_CSRFTester_Project OWASP|CSRFTester project page]].
 == Quick Steps ==

@@ Line 1: / Line 1: @@
 == Overview ==
-The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment. To download the tool, please visit the OWASP CSRFTester project page at https://www.owasp.org/index.php/Category:OWASP_CSRFTester_Project
+The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment.
 == Quick Steps ==
-The following is an outline of the steps necessary to launch and utilize the CSRFTester:
+An outline of the steps necessary to launch and utilize the CSRFTester:
-::# Update the JAVA_HOME environment variable in run.bat
+The CSRFTester distribution contains three files:
-== Launch OWASP CSRFTester ==
+# run.bat
-The CSRFTester distribution contains three files: run.bat, OWASP-CSRFTester-1.0.jar, and concurrent.jar. The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under C:\AppSecWorkbench\jdk16\jre. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and 'CD' directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.
+The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under <code>C:\AppSecWorkbench\jdk16\jre</code>. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and CD directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.
-== Record Execution of Business Functions ==
+=== Record Execution of Business Functions ===
-Once the CSRFTester loads successfully, we must record a transaction that we want to test for CSRF. First, we must configure the browser to proxy all HTTP traffic through CSRFTester. We can configure this proxy behavior in IE using the Tools menu. Select Tools -> Internet Options -> Connections -> LAN Settings to get the proxy configuration dialog.
+Once the CSRFTester loads successfully, we must record a transaction that we want to test for CSRF. First, configure the browser to proxy all HTTP traffic through CSRFTester. We can configure this proxy behavior in IE using the Tools menu: Select Tools > Internet Options > Connections > LAN Settings will display the proxy configuration dialog.
 [[Image:IE Proxy.PNG]]
@@ Line 28: / Line 39: @@
 CSRFTester defaults to using port 8008 on localhost for its proxy. You need to configure IE to relay requests to CSRFTester, rather than fetching them itself, as shown in the above image. Make sure that all checkboxes are unchecked, except for "Use a proxy server". Once you have configured IE to use the proxy, select Ok on all dialogs to get back to the browser. Browse to a non-SSL website, and then switch to CSRFTester.
-If the proxy was successfully configured, CSRFTester will generate debug messages to stdout for all subsequent HTTP requests generated by your browser. At this point, we need to locate a particular business function that we want to test for CSRF. Browse to the page where the business function ( or functions ) are first "loaded". Once this page is located, select the "Start Recording" button in CSRFTester and execute the business function or functions. Once complete, click the "Stop Recording" button within CSRFTester. You'll notice that the list on the main screen now has a serious of requests recorded. These are all of the GET/POST requests generated by our browser while executing the business function(s). By selecting one of the rows in the list, we now have the ability to modify the parameters that were used to execute the business function. We can modify the "query string" parameters and "form" parameters through their respective panes on the bottom half of the screen. Note that these are the values we wish to trick the end user into submitting. Once all of the parameters have been modified to contain your desired values, we are now ready to begin generating HTML reports.
+If the proxy was successfully configured, CSRFTester will generate debug messages to stdout for all subsequent HTTP requests generated by your browser. At this point, we need to locate a particular business function that we want to test for CSRF. Browse to the page where the business function (or functions) are first "loaded". Once this page is located, select the "Start Recording" button in CSRFTester and execute the business function or functions. Once complete, click the "Stop Recording" button within CSRFTester. You'll notice that the list on the main screen now has a series of requests recorded. These are all of the GET/POST requests generated by our browser while executing the business function(s). By selecting one of the rows in the list, we now have the ability to modify the parameters that were used to execute the business function. We can modify the "query string" parameters and "form" parameters through their respective panes on the bottom half of the screen. Note that these are the values we wish to trick the end user into submitting. Once all of the parameters have been modified to contain your desired values, we are now ready to begin generating HTML reports.
-== Generate HTML Reports ==
+=== Generate HTML Reports ===
 The HTML reports generated by the CSRFTester tool are used to carry out the CSRF test cases against other users of the web application. To generate a report, we first must select a "report type". The report type determines how we want the victims browser to submit the previously recorded requests. There currently exists 5 possible reports: forms, iFrame, IMG, XHR, and Link.

@@ Line 2: / Line 2: @@
 The following article describes how to utilize the OWASP CSRFTester to generate test cases during an application security assessment. To download the tool, please visit the OWASP CSRFTester project page at https://www.owasp.org/index.php/Category:OWASP_CSRFTester_Project
 == Launch OWASP CSRFTester ==
 The CSRFTester distribution contains three files: run.bat, OWASP-CSRFTester-1.0.jar, and concurrent.jar. The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under C:\AppSecWorkbench\jdk16\jre. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and 'CD' directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.
@@ Line 12: / Line 22: @@
 == Record Execution of Business Functions ==
-TBD: describe how to configure proxy
+Once the CSRFTester loads successfully, we must record a transaction that we want to test for CSRF. First, we must configure the browser to proxy all HTTP traffic through CSRFTester. We can configure this proxy behavior in IE using the Tools menu. Select Tools -> Internet Options -> Connections -> LAN Settings to get the proxy configuration dialog.
-TBD: describe how to start and stop recorded requests
-TBD: describe how to manipulate recorded requests (i.e. parameters, method, timing, etc.)
+[[Image:IE Proxy.PNG]]
 == Generate HTML Reports ==
-TBD: Describe the available report types
+The HTML reports generated by the CSRFTester tool are used to carry out the CSRF test cases against other users of the web application. To generate a report, we first must select a "report type". The report type determines how we want the victims browser to submit the previously recorded requests. There currently exists 5 possible reports: forms, iFrame, IMG, XHR, and Link.
-TBD: Describe how to generate the report
-TBD: Describe how to test the newly generated report
+ '''Forms''': This report type will submit the request(s) using auto-posting forms

← Older revision		Revision as of 16:48, 21 November 2007
Line 9:		Line 9:

	The CSRFTester distribution contains three files: run.bat, OWASP-CSRFTester-1.0.jar, and concurrent.jar. The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under C:\AppSecWorkbench\jdk16\jre. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and 'CD' directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.		The CSRFTester distribution contains three files: run.bat, OWASP-CSRFTester-1.0.jar, and concurrent.jar. The run.bat script configures the classpath to include the required jars and invokes the appropriate main class. Currently, the batch script assumes your JDK runtime exists under C:\AppSecWorkbench\jdk16\jre. Obviously, this will not be the correct location of your JVM. Make sure you '''update the JAVA_HOME environment variable''' in run.bat before attempting to execute the batch file. Assuming proper configuration, executing run.bat should launch CSRFTester. If an error occurs, evident when the command line interface quickly disappears, consider opening up a separate CLI and 'CD' directly to the folder of your run.bat file and execute it via command line. Any errors that may occur will display to stdout.
		+
		+	== Record Execution of Business Functions ==
		+
		+	TBD: describe how to configure proxy
		+	TBD: describe how to start and stop recorded requests
		+	TBD: describe how to manipulate recorded requests (i.e. parameters, method, timing, etc.)
		+
		+	== Generate HTML Reports ==
		+
		+	TBD: Describe the available report types
		+	TBD: Describe how to generate the report
		+	TBD: Describe how to test the newly generated report