Strix•CSRF 测试

CSRF

Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.

Attack Surface

Session Types

• Web apps with cookie-based sessions and HTTP auth
• JSON/REST, GraphQL (GET/persisted queries), file upload endpoints

Authentication Flows

• Login/logout, password/email change, MFA toggles

OAuth/OIDC

• Authorize, token, logout, disconnect/connect endpoints

High-Value Targets

• Credentials and profile changes (email/password/phone)
• Payment and money movement, subscription/plan changes
• API key/secret generation, PAT rotation, SSH keys
• 2FA/TOTP enable/disable; backup codes; device trust
• OAuth connect/disconnect; logout; account deletion
• Admin/staff actions and impersonation flows
• File uploads/deletes; access control changes

Reconnaissance

Session and Cookies

• Inspect cookies: HttpOnly, Secure, SameSite (Strict/Lax/None)
• Lax allows cookies on top-level cross-site GET; None requires Secure
• Determine if Authorization headers or bearer tokens are used (generally not CSRF-prone) versus cookies (CSRF-prone)

Token and Header Checks

• Locate anti-CSRF tokens (hidden inputs, meta tags, custom headers)
• Test removal, reuse across requests, reuse across sessions, binding to method/path
• Verify server checks Origin and/or Referer on state changes
• Test null/missing and cross-origin values

Method and Content-Types

• Confirm whether GET, HEAD, or OPTIONS perform state changes
• Try simple content-types to avoid preflight: application/x-www-form-urlencoded, multipart/form-data, text/plain
• Probe parsers that auto-coerce text/plain or form-encoded bodies into JSON

CORS Profile

• Identify Access-Control-Allow-Origin and -Credentials
• Overly permissive CORS is not a CSRF fix and can turn CSRF into data exfiltration
• Test per-endpoint CORS differences; preflight vs simple request behavior can diverge

Key Vulnerabilities

Navigation CSRF

• Auto-submitting form to target origin; works when cookies are sent and no token/origin checks are enforced
• Top-level GET navigation can trigger state if server misuses GET or links actions to GET callbacks

Simple Content-Type CSRF

• application/x-www-form-urlencoded and multipart/form-data POSTs do not require preflight
• text/plain form bodies can slip through validators and be parsed server-side

JSON CSRF

• If server parses JSON from text/plain or form-encoded bodies, craft parameters to reconstruct JSON
• Some frameworks accept JSON keys via form fields (e.g., data[foo]=bar) or treat duplicate keys leniently

Login/Logout CSRF

• Force logout to clear CSRF tokens, then chain login CSRF to bind victim to attacker's account
• Login CSRF: submit attacker credentials to victim's browser; later actions occur under attacker's account

OAuth/OIDC Flows

• Abuse authorize/logout endpoints reachable via GET or form POST without origin checks
• Exploit relaxed SameSite on top-level navigations
• Open redirects or loose redirect_uri validation can chain with CSRF to force unintended authorizations

File and Action Endpoints

• File upload/delete often lack token checks; forge multipart requests to modify storage
• Admin actions exposed as simple POST links are frequently CSRFable

GraphQL CSRF

• If queries/mutations are allowed via GET or persisted queries, exploit top-level navigation with encoded payloads
• Batched operations may hide mutations within a nominally safe request

WebSocket CSRF

• Browsers send cookies on WebSocket handshake
• Enforce Origin checks server-side; without them, cross-site pages can open authenticated sockets and issue actions

Bypass Techniques

SameSite Nuance

• Lax-by-default cookies are sent on top-level cross-site GET but not POST
• Exploit GET state changes and GET-based confirmation steps
• Legacy or nonstandard clients may ignore SameSite; validate across browsers/devices

Origin/Referer Obfuscation

• Sandbox/iframes can produce null Origin; some frameworks incorrectly accept null
• about:blank/data: URLs alter Referer
• Ensure server requires explicit Origin/Referer match

Method Override

• Backends honoring _method or X-HTTP-Method-Override may allow destructive actions through a simple POST

Token Weaknesses

• Accepting missing/empty tokens
• Tokens not tied to session, user, or path
• Tokens reused indefinitely; tokens in GET
• Double-submit cookie without Secure/HttpOnly, or with predictable token sources

Content-Type Switching

• Switch between form, multipart, and text/plain to reach different code paths
• Use duplicate keys and array shapes to confuse parsers

Header Manipulation

• Strip Referer via meta refresh or navigate from about:blank
• Test null Origin acceptance
• Leverage misconfigured CORS to add custom headers that servers mistakenly treat as CSRF tokens

Special Contexts

Mobile/SPA

• Deep links and embedded WebViews may auto-send cookies; trigger actions via crafted intents/links
• SPAs that rely solely on bearer tokens are less CSRF-prone, but hybrid apps mixing cookies and APIs can still be vulnerable

Integrations

• Webhooks and back-office tools sometimes expose state-changing GETs intended for staff
• Confirm CSRF defenses there too

Chaining Attacks

• CSRF + IDOR: force actions on other users' resources once references are known
• CSRF + Clickjacking: guide user interactions to bypass UI confirmations
• CSRF + OAuth mix-up: bind victim sessions to unintended clients

Testing Methodology

• Inventory endpoints - All state-changing endpoints including admin/staff
• Note request details - Method, content-type, whether reachable via simple requests
• Assess session model - Cookies with SameSite attrs, custom headers, tokens
• Check defenses - Anti-CSRF tokens and Origin/Referer enforcement
• Attempt preflightless delivery - Form POST, text/plain, multipart/form-data
• Test navigation - Top-level GET navigation
• Cross-browser validation - Behavior differs by SameSite and navigation context

Validation

• Demonstrate a cross-origin page that triggers a state change without user interaction beyond visiting
• Show that removing the anti-CSRF control (token/header) is accepted, or that Origin/Referer are not verified
• Prove behavior across at least two browsers or contexts (top-level nav vs XHR/fetch)
• Provide before/after state evidence for the same account
• If defenses exist, show the exact condition under which they are bypassed (content-type, method override, null Origin)

False Positives

• Token verification present and required; Origin/Referer enforced consistently
• No cookies sent on cross-site requests (SameSite=Strict, no HTTP auth) and no state change via simple requests
• Only idempotent, non-sensitive operations affected

Impact

• Account state changes (email/password/MFA), session hijacking via login CSRF
• Financial operations, administrative actions
• Durable authorization changes (role/permission flips, key rotations) and data loss

Pro Tips

• Prefer preflightless vectors (form-encoded, multipart, text/plain) and top-level GET if available
• Test login/logout, OAuth connect/disconnect, and account linking first
• Validate Origin/Referer behavior explicitly; do not assume frameworks enforce them
• Toggle SameSite and observe differences across navigation vs XHR
• For GraphQL, attempt GET queries or persisted queries that carry mutations
• Always try method overrides and parser differentials
• Combine with clickjacking when visual confirmations block CSRF

Summary

CSRF is eliminated only when state changes require a secret the attacker cannot supply and the server verifies the caller's origin. Tokens and Origin checks must hold across methods, content-types, and transports.