XSRFProbe: CSRF audit toolkit with crawler and proof-of-concept generation

What XSRFProbe is built to find

XSRFProbe is an open source Python toolkit for auditing Cross Site Request Forgery vulnerabilities and generating exploitable proof of concepts. Its scope is narrow and deliberate: it does not try to be a general web vulnerability scanner, it focuses on CSRF and the ways applications attempt to stop it. The audience is security testers, developers, and reviewers who need to decide whether a given endpoint can be forged across an authenticated session.

The problem it addresses is that CSRF defenses are easy to get partially right. A token may exist but not be bound to the session, a Referer check may be bypassed by omitting the header, or a SameSite cookie may be absent. XSRFProbe runs a battery of systematic checks, backed by a response diffing and benchmark engine, before it declares an endpoint vulnerable. Each finding carries a severity rating and, where relevant, an exploitability precondition, and the toolkit can generate both normal and maliciously exploitable proof of concepts.

How the crawl and the checks fit together

The scan starts with a crawler that is deterministic and bounded. The crawl can be limited with --max-urls, --max-depth, and --crawl-timeout, which keeps a run from expanding into an unbounded site walk. For each discovered form or request, XSRFProbe applies checks identified by short codes such as T6 or R2a; the code is printed in the console and stored as test_id in the JSON report.

A response diffing and benchmark engine sits underneath the checks, so a result is based on comparing responses rather than on a single status code. Optional headless Firefox integration through Selenium (--browser) enables browser-dependent tests and automatic validation of generated proof of concepts. Subdomain enumeration through crt.sh is available for sibling-domain bypass testing against SameSite protections. Token strength is assessed with entropy and encoding checks, and a post-scan analysis evaluates token predictability and forgeability.

Installing XSRFProbe and running a first scan

Installation follows the Python packaging in the repository. The project requires Python 3.10 or newer according to setup.py, while the README badge states Python 3.11 or newer. Dependencies are listed in requirements.txt.

The requirements are requests, beautifulsoup4, pydantic, selenium, and rapidfuzz, and setup.py defines the console entry point xsrfprobe = xsrfprobe.xsrfprobe:startEngine. The README itself points to the wiki Getting Started page for full usage, so the repository does not contain a step-by-step first-run walkthrough in the README; expect to consult that wiki. A typical run limits the crawl and points at a target you are authorized to test, using the documented flags --max-urls, --max-depth, and --crawl-timeout. Console output shows check identifiers such as [T6] VULNERABLE, and results are written as a JSON report.

The tampering and bypass tests in detail

The check catalog is organized by category and each test has a stable identifier. Token presence checks are D1 for a request with no anti-CSRF token and D2 for a login form lacking one. Token tampering checks range from T2, where validation is tied to the request method and can be switched between GET and POST, through T8, where a custom-header token can be omitted or forged. Method and Content-Type checks are M1, M2, and M4, covering HTTP method override via _method or X-HTTP-Method-Override and bypass via an alternate Content-Type. Referer checks are R0, R1, and R2a through R2c, covering missing validation, omission bypass, and regex bypasses using subdomains, query strings, or paths. Origin checks are O1 through O3, covering Origin: null, subdomain tricks, and omission. SameSite checks S2 through S4 require the browser integration and cover client-side redirect gadgets, XSS on a sibling subdomain, and cookie-refresh or OAuth flows. Cookie posture checks are C1 and C2. Token strength checks are E1 for weak or structured hash encoding and A1 for post-scan predictability and forgeability analysis.

When XSRFProbe is the wrong choice

XSRFProbe is the wrong tool when the problem is not CSRF. It will not find injection, authentication, or access-control issues, and it assumes a target that returns HTML forms or state-changing endpoints it can crawl. The browser-dependent checks and proof-of-concept validation require Selenium and a headless Firefox installation, which adds setup and runtime cost that the HTTP-level checks do not need. Subdomain enumeration depends on crt.sh, so it is only as complete as that data source.

There is also a maintenance gap worth noting: the release history jumps from v2.3.1 on 2020-01-29 to v3.0.0 on 2026-07-12. The README does not document an upgrade path from v2.x, and it does not document rollback or CI integration. Teams moving from an older version should expect to relearn the configuration surface.

How it compares with manual CSRF testing

Compared with a manual workflow, the difference is coverage and repeatability. A tester working by hand captures one request, removes or empties the token, and observes whether the server still accepts it. XSRFProbe repeats that style of tampering across a crawl and adds Referer, Origin, method override, Content-Type, SameSite, and cookie-posture checks in the same run, then records each result with a test identifier and severity. The trade-off is that automated tampering can miss application-specific logic that a human tester would notice, and it depends on the crawler reaching the endpoints in the first place.

Maintenance cost, dependencies, and licensing

Runtime dependencies are requests 2.25 or newer, beautifulsoup4 4.9 or newer, rapidfuzz 2.0 or newer, pydantic 2.0 or newer, and selenium 4.0 or newer. The browser checks require a working Firefox and Selenium setup in addition to the Python packages. The project is licensed under GPLv3, so redistribution and derivative works carry the license's copyleft terms; this is a license fact, not legal advice, and anyone shipping a modified version should read the full license text.

Editorial conclusion

Adopt XSRFProbe if you audit CSRF on applications you own and want a crawler that generates proof of concepts with severity ratings; skip it if you need a general web vulnerability scanner or cannot provide the optional Firefox and Selenium setup; verify first that your target scope, crawl bounds, and token handling match what the tool checks.

Frequently asked questions

Official sources

1. 0xInfection/XSRFProbe on GitHub
2. Issues
3. License: GPL-3.0
4. README
5. Releases