Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stops at detecting forms #63

Open
4 tasks done
X-l-l-l opened this issue Jul 2, 2024 · 0 comments
Open
4 tasks done

Stops at detecting forms #63

X-l-l-l opened this issue Jul 2, 2024 · 0 comments

Comments

@X-l-l-l
Copy link

X-l-l-l commented Jul 2, 2024

Describe the bug

When i try to use the tool, seems like, on a url that ends with /, it ends at retreaving forms, which the page has, but apparently the tool doesn't think so.

Command You Used

xsrfprobe -u http://127.0.0.1/vulnerabilities/csrf/ -c "PHPSESSID=pee4sgbjm74s57o43h39vevqo0; security=low"

Full Stack Trace Error

     _____       _____       _____      _____       _____
  __|__   |_  __|___  |_  __|___  |_  _|____ |_   _|____ |_  _____   _____  ______  ______
 \  `  /    ||   ___|   ||  _  _|   ||   ___|  | |   _  |  ||  _ ,' /     \|  _   )|   ___|
  >   <     | `-.`-.    ||     \    ||   ___|  | |    __|  ||     \ |  -  || |_  { |   ___|
 /__/__\   _||______|  _||__|\__\  _||___|    _| |___|    _||__|\__\\_____/|______)|______|
    |_____|     |_____|     |_____|    |_____|     |_____|


   [---]            XSRFProbe, A Cross Site Request Forgery Audit Toolkit          [---]
   [---]                                                                           [---]
   [---]                       ~  Author : Pinaki Mondal  ~                        [---]
   [---]                      ~  github.com / 0xInfection  ~                       [---]
   [---]                                                                           [---]
   [---]                           ~  Version 2.3.1  ~                             [---]

 [!] Testing site 127.0.0.1 status...
 [+] Site seems to be up!
 [!] Testing vulnerabilities/csrf/ endpoint status...
 [+] Endpoint seems to be up!
 [*] Preparing the request...
 [*] Processing the GET Request...
 [!] Trying to parse response...
 [!] Checking endpoint request validation via Referer Checks...

 +--------------------------------------+
 |   Referer Based Request Validation   |
 +--------------------------------------+

 [!] Making request on normal basis...
 [*] Preparing the request...
 [*] Processing the GET Request...
 [*] Setting generic headers...
 [!] Making request with Tampered Referer Header...
 [*] Preparing the request...
 [*] Processing the GET Request...
 [-] Endpoint Referer Validation Not Present!
 [-] Heuristics reveal endpoint might be  VULNERABLE  to Origin Based CSRFs...
 [+] Possible CSRF Vulnerability Detected : http://127.0.0.1/vulnerabilities/csrf/!
 [+] Possible Vulnerability Type:  No Referer Based Request Validation
 [!] Confirming the vulnerability...
 [!] Confirming endpoint request validation via Origin Checks...

 +-------------------------------------+
 |   Origin Based Request Validation   |
 +-------------------------------------+

 [!] Making request on normal basis...
 [*] Preparing the request...
 [*] Processing the GET Request...
 [*] Setting generic headers...
 [!] Making request with Tampered Origin Header...
 [*] Preparing the request...
 [*] Processing the GET Request...
 [-] Endpoint Origin Validation Not Present!
 [-] Heuristics reveal endpoint might be  VULNERABLE  to Origin Based CSRFs...
 [+] Possible CSRF Vulnerability Detected : http://127.0.0.1/vulnerabilities/csrf/!
 [!] Possible Vulnerability Type:  No Origin Based Request Validation

 [!] Retrieving all forms on http://127.0.0.1/vulnerabilities/csrf/...

 [+] Scan completed!

Potential cause or fix

[Do you know what could be causing the problem or how to fix it?]

Environment:

  • OS: Linux docker-desktop 5.15.133.1-microsoft-standard-WSL2
  • Python version: 3.10.12

Some Questions

  • I am using the latest version of XSFRProbe.
  • I installed the dependecies using pip3 instead of pip.
  • I have read the documentation before submitting this issue.
  • I have checked the other issues to see if someone reported this before.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant