Implement anti-CSRF protection bypass #2

bdamele · 2012-06-26T14:14:31Z

I think that this can be done taking advantage of the object that handles --forms (forms parsing) switch.

bdamele · 2012-12-20T10:58:16Z

Sometimes applications implement CSRF protection in a stronger way: the token is renewed upon a refresh and invalidated server-side once used.

sqlmap could handle this case as follows:

user provides --form (or a --data with inside some param named like nonce or token).
sqlmap recognizes possible CSRF token(s).
sqlmap asks user "are these X parameters, tokens?"
user says Yes.
sqlmap automatically performs a request to the original page.
sqlmap extracts from the response body the token value.
sqlmap performs the request to the target page (form in case of --forms, same page in case of --data) with the extracted value of token.

tennessee · 2013-05-17T16:39:46Z

Good day!

sqlmap does not recognize the CSRF token. The parameter name token is not quite standard, I tried to change it to mean 'token' or 'nonce' but that, unfortunately, had no effect! Can I somehow explicitly in sqlmap option to define a token. Thank you!

stamparm · 2014-10-22T19:20:30Z

Either user explicitly states the anti-CSRF token name (e.g. --csrf-token) or sqlmap automatically recognizes it (and asks user if it's correct in recognition) (e.g. csrf_token or csrf_nonce). If everything goes well, anti-CSRF token would be extracted after the dummy request/response and stored for usage in the following SQLI request.

p.s. case where this all would be problematic is the multi-threaded data retrieval

stamparm · 2014-10-23T09:26:51Z

New options:

$ python sqlmap.py -hh | grep CSRF
    --csrf-token=CSR..  Parameter used to hold CSRF protection token
    --csrf-url=CSRFURL  URL address to visit to extract CSRF protection token

Option --csrf-url doesn't have to be explicitly used if the original --url carries the CSRF protection token

stamparm · 2014-10-23T09:47:59Z

Example run:

python sqlmap.py -u "http://debiandev/sqlmap/mysql/csrf/post.php" --csrf-token="secret_token" --csrf-url="http://debiandev/sqlmap/mysql/csrf/" --data="id=1&secret_token="  --flush-session --batch -v 6

...

[11:45:20] [TRAFFIC OUT] HTTP request [#42]:
GET /sqlmap/mysql/csrf/ HTTP/1.1
Accept-language: en-us,en;q=0.5
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-7fc9e82 (http://sqlmap.org)
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: debiandev
Pragma: no-cache
Cache-control: no-cache,no-store
Cookie: PHPSESSID=4bca6044f9b0c382fb6771a745498dfe
Connection: close

[11:45:20] [TRAFFIC IN] HTTP response [#42] (200 OK):
Content-length: 173
X-powered-by: PHP/5.2.6-1+lenny4
Content-encoding: gzip
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Uri: http://debiandev/sqlmap/mysql/csrf/
Server: Apache/2.2.9
Connection: close
Pragma: no-cache
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Date: Thu, 23 Oct 2014 09:45:29 GMT
Content-type: text/html



<html>
<form method="POST" name="csrfguard_sample" action="post.php">
  <input type="text" name="id">
  <input type="hidden" name="secret_token" value="14140575295448ce39011c2">
  <input type="submit" value="Submit">
</form>

[11:45:20] [TRAFFIC OUT] HTTP request [#43]:
POST /sqlmap/mysql/csrf/post.php HTTP/1.1
Accept-language: en-us,en;q=0.5
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-7fc9e82 (http://sqlmap.org)
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: debiandev
Pragma: no-cache
Cache-control: no-cache,no-store
Content-type: application/x-www-form-urlencoded; charset=utf-8
Cookie: PHPSESSID=4bca6044f9b0c382fb6771a745498dfe
Content-length: 41
Connection: close

id=1&secret_token=14140575295448ce39011c2

...

stormwin · 2014-10-23T11:33:35Z

I have seen some web sites that store csrf token in cookie. When we make a request to the server, some of them expect token to be at the end of URL or post data, and some of them expect a token in headers like X-CSRF-TOKEN: 14140575295448ce39011c2... what about the last case with token in headers, does sqlmap support that?

stamparm · 2014-10-23T11:52:53Z

Not (yet). Problem is that in those cases (as I know), necessary changes are being done with the usage of Javascript, which is a huge obstacle.

p.s. @stormwin do you have one of those examples around?

stamparm · 2014-10-23T12:06:43Z

inurl:"services/session/token"

p.s. the whole process is described here: http://tylerfrankenstein.com/code/drupal-services-csrf-token-firefox-poster
p.p.s. going to implement this too

stamparm · 2014-10-23T12:40:56Z

@stormwin Implemented support for X-CSRF-TOKEN (too)

Example run:

python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --headers="X-CSRF-Token: oTpCTAKvWui1gsp3itVdZOu9F2BQxU55N323S51BWJ0" --csrf-url="http://debiandev/services/session/token" --csrf-token=x-csrf-token -v 6

...

[14:35:18] [TRAFFIC OUT] HTTP request [#1]:
GET /services/session/token HTTP/1.1
Host: debiandev
X-CSRF-Token: oTpCTAKvWui1gsp3itVdZOu9F2BQxU55N323S51BWJ0
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-abbd352 (http://sqlmap.org)
Connection: close

[14:35:19] [INFO] heuristics detected web page charset 'ascii'
[14:35:19] [TRAFFIC IN] HTTP response [#1] (200 OK):
Content-length: 170
Set-cookie: PHPSESSID=1f45b44924edc6ec8375a58a57e03c9d; path=/
<snip>
Content-type: text/plain

Hv6eT8LnbJtGV_cJ8RKHy3Y98qBX-0GBSjkhQNrVuko
[14:35:19] [TRAFFIC OUT] HTTP request [#2]:
GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
Host: debiandev
X-CSRF-Token: Hv6eT8LnbJtGV_cJ8RKHy3Y98qBX-0GBSjkhQNrVuko
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-abbd352 (http://sqlmap.org)
Cookie: PHPSESSID=1f45b44924edc6ec8375a58a57e03c9d
Connection: close

...

p.s. basically, in those kind of cases (with X-CSRF-Token header value) CSRF protection token is given in raw text/plain form by visiting a special page (e.g. ...services/session/token)

stormwin · 2014-10-23T13:19:17Z

@stamparm nice... i will test this at the weekend.

just to sum up:

server can set up csrf token in:

HTML Forms
Cookie
Headers (haven't seen this yet, but it is possible i think)
*some applications randomizing value of csrf token on every request, and some, occasionally (for example on every 5 minutes)

server can expect request from user with csrf token in:

URL
In POST Data
In Header

stamparm · 2014-10-23T13:23:53Z

@stormwin I am still in need for a page utilizing CSRF tokens through Cookie. sqlmap still doesn't support this.

codewatchorg · 2014-11-16T21:17:14Z

The latest CSRF updates break sqlmapapi as sqlmap appears to expect the csrfUrl option to be set. When it isn't set then sqlmapapi errors out with a log that the csrfUrl option is missing (this is one that isn't auto set by the API).

It's not a big deal as the work around is to manually set the config option with /option//set.

stamparm · 2014-11-17T10:50:38Z

@codewatchorg thank you for your report. It should be fixed with the latest revision

pich4ya · 2015-03-14T09:44:01Z

How about CSRF token in either javascript code

<script>
window.csrf = 'aaaabbbbcccc';
</script>

or in JSON format

{"csrf":"bf4676dc51856f01"}

and how about CSRF token which required POST data?
I request the option to extract token using supplied user regex

stamparm · 2015-03-16T14:02:49Z

@pich4ya those would be non-standard (custom) CSRF protection methods. In those kind of cases you would need to run either Burp or similar tool.

I can make that "regex", but how to know (as it's non-standard), where the end point expects the token to appear? If the answer is "make the option for that too", I'll need to deny as it would become one of those options/switches that nobody uses

nu11secur1ty · 2022-04-11T10:16:58Z

--csrf-url="https://www.blabal.com/tarator/kokazako/?page=8" --csrf-token="token"

;)

ghost assigned stamparm Jun 26, 2012

stamparm mentioned this issue Jul 7, 2012

Reimplement counting of dumped entries #71

Closed

stamparm added a commit that referenced this issue Sep 6, 2012

Minor update for an Issue #2

c3d191e

stamparm added a commit that referenced this issue Oct 19, 2012

Implementation for an Issue #2

d65d9e2

stamparm added a commit that referenced this issue Oct 19, 2012

Update for an Issue #2

6a271fe

stamparm closed this as completed Oct 19, 2012

chym mentioned this issue Nov 10, 2012

error-based false #231

Closed

bdamele reopened this Dec 20, 2012

dedust mentioned this issue Aug 9, 2013

unable to retrieve the number of entries for table #502

Closed

P3NT3ST mentioned this issue May 12, 2014

CSV wrong sorting (mixed order) when finish to dump huge table #690

Closed

zeusfnx mentioned this issue May 14, 2014

Os-bof not permitted when the subquery follows = , <= > >= #691

Closed

digininja mentioned this issue Aug 12, 2014

Broken link #789

Closed

stamparm changed the title ~~Implement anti-CSRF protection bypass (e.g. .NET VIEWSTATE)~~ Implement anti-CSRF protection bypass Oct 23, 2014

stamparm added a commit that referenced this issue Oct 23, 2014

Implementation for an Issue #2

fc1b05b

stamparm added a commit that referenced this issue Oct 23, 2014

Update for an Issue #2

780dbd1

stamparm added a commit that referenced this issue Oct 23, 2014

Basic options check for Issue #2

32bcca0

stamparm added a commit that referenced this issue Oct 23, 2014

Minor update for the Issue #2

01f4b76

stamparm added a commit that referenced this issue Oct 23, 2014

Minor fix related to the Issue #2

95f2e61

stamparm added a commit that referenced this issue Oct 23, 2014

Support for X-CSRF-TOKEN header (Issue #2)

abbd352

stamparm added a commit that referenced this issue Nov 17, 2014

Update and patch for an Issue #2

05d5342

bf30075 pushed a commit to bf30075/sqlmap that referenced this issue Nov 17, 2014

Update and patch for an Issue sqlmapproject#2

1ac5c8a

stamparm closed this as completed Nov 24, 2014

bdamele added normal and removed low labels Feb 13, 2015

franx47 mentioned this issue Mar 11, 2015

-g, --crawl and dumping data issues #1191

Closed

jeroen-80 mentioned this issue Mar 25, 2015

Payload injected in referer, not in uri #1205

Closed

franx47 mentioned this issue Apr 30, 2015

--search & --dump issue, and Automatic Tamper #1234

Closed

Kamulha mentioned this issue Jul 24, 2015

File write on PostgreSQL 9.1.15 fails #1170

Closed

Isa047 mentioned this issue Oct 15, 2015

Simple SQL error confirmed with Burp repeater but not detected in sqlmap #1468

Closed

bdamele modified the milestones: 1.0, 1.1 May 16, 2016

gudewolu mentioned this issue Feb 17, 2017

not authorized, try to provide right HTTP authentication type and valid credentials (401) #2400

Closed

aburehan mentioned this issue Jul 19, 2017

got db but am not getting tables #2610

Closed

anhkhoa14592 mentioned this issue Aug 19, 2017

anti-CSRF token 'token' can't be found at response although the token is existed #2659

Closed

LeetDemon mentioned this issue Dec 4, 2017

Is This SQL-injection ? #2814

Closed

amirnsahmad mentioned this issue Dec 7, 2017

ViewSTATE and Eventvalidation are changing at runtime #2819

Closed

shahzadmuh mentioned this issue Jan 13, 2018

decode hex output of oracle daatabase #2856

Closed

vayo8888 mentioned this issue Jul 22, 2018

True - delay, false - http error #3195

Closed

serptt mentioned this issue Feb 12, 2019

False positive or something else? #3490

Closed

snipercatz mentioned this issue Feb 18, 2019

SQLMAP unable to identify injection point #3493

Closed

R477U5 mentioned this issue Mar 27, 2020

Issue with file-write #4156

Closed

reybango mentioned this issue May 4, 2020

ORDER BY clause in UNION causes no results to be returned #4187

Closed

hastalamuerte mentioned this issue Jun 4, 2020

sqlmap -r file and custom payload in GET method #4223

Closed

janKuefner mentioned this issue Jul 8, 2021

Mulipart/form-data boundary is dynamic, sqlmap however uses a static value #4730

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement anti-CSRF protection bypass #2

Implement anti-CSRF protection bypass #2

bdamele commented Jun 26, 2012

bdamele commented Dec 20, 2012

tennessee commented May 17, 2013

stamparm commented Oct 22, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stormwin commented Oct 23, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stormwin commented Oct 23, 2014

stamparm commented Oct 23, 2014

codewatchorg commented Nov 16, 2014

stamparm commented Nov 17, 2014

pich4ya commented Mar 14, 2015

stamparm commented Mar 16, 2015

nu11secur1ty commented Apr 11, 2022

Implement anti-CSRF protection bypass #2

Implement anti-CSRF protection bypass #2

Comments

bdamele commented Jun 26, 2012

bdamele commented Dec 20, 2012

tennessee commented May 17, 2013

stamparm commented Oct 22, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stormwin commented Oct 23, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stamparm commented Oct 23, 2014

stormwin commented Oct 23, 2014

stamparm commented Oct 23, 2014

codewatchorg commented Nov 16, 2014

stamparm commented Nov 17, 2014

pich4ya commented Mar 14, 2015

stamparm commented Mar 16, 2015

nu11secur1ty commented Apr 11, 2022