Getting Started

Compatibility

Python Versions

Originally built on Python 2, XSRFProbe later was migrated to Python 3 due to the approaching end of Python 2 as well as some missing features in Python 2.x versions, which did not allow optimised performance and even caused some dependency issues.

XSRFProbe requires Python 3.10 or newer.

Operating Systems

XSRFProbe has been tested on Linux (Arch, Debian, Ubuntu), Windows and Mac, and works as expected. Feel free to report any bugs you might encounter.

Colors

XSRFProbe uses plain-text status markers rather than coloured output, so it renders identically across every terminal and operating system. Log lines are prefixed by their level ([*] info/progress, [+] success, [!] warning, [-] error, [~] debug), and the end-of-scan summary reports severity as HIGH/MEDIUM/LOW in a table.

Dependencies

XSRFProbe needs some libraries to run efficiently. Apart from in-built libraries, some require installation via pip.

Following are the dependencies that the XSRFProbe engine requires:

• requests - For making HTTP queries.
• beautifulsoup4 - An HTML parser for web pages.
• rapidfuzz - Fast string distance metrics for the response diff engine and token analysis.
• pydantic - Data models for findings and the JSON report.
• selenium - Drives headless Firefox for the browser-dependent tests.

Rest of the Python libraries used by XSRFProbe are standard libraries which come pre-installed with a Python 3.x interpreter.

NOTE: The browser-dependent tests additionally need Firefox and geckodriver installed, but only when you run with --browser.

Installation

Via Pip:

XSRFProbe can be easily installed via a simple command if you have pip:

pip install xsrfprobe

Manually:

Or you can install it yourself. For setting the tool up: ➲ Clone the repo locally and navigate to the directory.

git clone https://github.com/0xinfection/XSRFProbe.git
cd XSRFProbe/

➲ Install XSRFProbe along with its dependencies.

pip install .

➲ Launch the script.

xsrfprobe --help

You'll see the list of arguments XSRFProbe takes in. Let the scanner load up. It confirms that the site is up and thus the scanning process begins. For more info, head over to the General Usage section.