How to test CSRF vulnarabilities

1. Look for areas in your application that will perform an action on the user's behalf, using their security context, in response to an HTTP GET request.
2. Create a URL address for the malicious action to be performed. For example: http://malicious.com/[action]
3. Create an email that contains HTML that references that URL address. For example, the img tag could be used
4. Log into a valid testing account as the "victim".
5. After successfully authentication has occurred, click on the malicious testing link in the email that was previously created.
6. Observe the results. If the web server executed the request contained within the malicious email, a CSRF vulnerability was found!

This test makes use of the fact that the resources were available via the HTTP GET request. POST requests can also be vulnerable to CSRF, but these requests must be done using a scripting language that will auto-submit a form that includes the malicious tags.

One of the common mistakes that users make is that the CSRF attack will take advantage of the fact that many users forget to logout of web applications when they are finished using them. Doing this doesn't give the web applications a chance to clear their session IDs or other types of session information from the cookie, allowing the CSRF attack to be successful even when the user is not actively browsing vulnerable websites.

Please refer this link for more details http://www.owasp.org/index.php/CSRF

Cross Site Request Forgery attack CSRF

Cross-Site Request Forgery (CSRF ) is an attack that tricks the victim's browser into performing an undesired action on the victim's behalf. For example, this attack could result in a transfer of funds, changing a password, or purchasing an item. For most websites browsers will automatically include any credentials associated with the site when they perform these types of actions. If the victim is currently authenticated to use a website, there is no way for the browser to distinguish between a valid action chosen by the user or a malicious action initiated by an attacker due to the exploitation of a CSRF vulnerability.

VSTS 2010 new tools

Microsoft will provide a new tool for addressing the "NoRepro" bugs. Please read more about this in Som's blog.



Enjoy