search

AlaBouali / bane

The "bane" Python library stands out as a robust toolkit catering to a wide spectrum of cybersecurity and networking tasks. Its versatile range of functionalities covers various aspects, including bruteforce attacks, cryptographic methods, DDoS attacks, information gathering, botnet creation and management, and CMS vulnerability scanning and more..
https://alabouali.medium.com/
MIT License
287 stars 56 forks source link

To good to be true #10

Closed TotallyNotAHaxxer closed 11 months ago

TotallyNotAHaxxer commented 2 years ago

i spent around a day looking at the code, and comparing it to other frameworks that work in the same way. i have to say while the code is nicely built the code seems to easy to be true. Most decent, secure, and accurate code for CSRF takes hundreds and hundreds of lines of code even being split into modules not 100 lines and everything works. can you explain or show any demos of how this module or library actually works?

AlaBouali commented 11 months ago

i took a different approach to test here: 1- i load the page twice and keep th response of them both 2- i check if there is any inputs that have changed between the two 3- i search for CSRF tokens in hidden inputs 4- submit each form with random referer header 6- check for response code status and if i get all / some / none of the data in the response

any form passes all the above tests i'm 100% sure it's vulnerable to CSRF. I kept in my mind that nowadays with the new secured frameworks, if there is a CSRF token then it's not vulnerable and i tend to look for something 100% sure rather than a false positive.