How to detect CSRF vulnerability, reliably?
summary
Scans with Arachne, ZAP and a commercial scanner repeatedly detect reflected XSS but fail CSRF: Arachne gives false negatives, ZAP gives false positives, the commercial product behaves similarly. A 50–100 line test harness using a headless browser (HtmlUnit) programmatically checks for no token present, empty token value, and missing server‑side validation, requiring two inputs: the exact CSRF field name and the exact error response. The checker runs in CI and reports the specific failure mode.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03Project context and goals
- 4:46Test application overview
- 9:03Scanner performance analysis
- 13:51The challenge of CSRF tokens
- 18:52Requirement for agreement
- 24:02Server-side validation issues
- 29:42Custom testing code demo
- 37:10Advantages and conclusion
related talks
43m Web Application Vulnerability Scanners: An Intro & Discussion
29mDon't Trust, Verify! - How I Found a CSRF Bug Hiding...
54mEverything You Wanted to Know About Client side CSRF But Were Afraid to Ask
45mCSRF: not all defenses are created equal
40mModern Web Application Defense with OWASP Tools
35mFlagship Projects: CSRFGuard
38mExploiting Client-Side Path Traversal: CSRF Is Dead, Long Live CSRF
45mSecurity Testing with OWASP ZAP in CI/CD