diff --git a/modules/twitterxsrf.py b/modules/twitterxsrf.py new file mode 100644 index 0000000..040707b --- /dev/null +++ b/modules/twitterxsrf.py @@ -0,0 +1,26 @@ +from rawweb import * +def main(raw_stream,ssl): + ''' + This Burpy module is specially written to find CSRF vulnerability in Twitter Application. + It has already found few minor and one major CSRF vulnerability in Twitter. + It simply checks whether CSRF token validation is present in Server Side or not by removing token from request and replaying it. + Twitter application always shows a generic error message for CSRF error which is "Your account may not be allowed to perform this action." + If this error is not present in response after removing the token it returns +ve. + ''' + title = [ + "Possible XSRF", #Please don't add