├── .gitignore
├── modules
├── clickjacking.py
├── samplexsrf.py
├── twitterxsrf.py
└── fbxsrf.py
├── burpy.py
├── README.md
├── rawweb.py
├── core.py
└── LICENSE
/.gitignore:
--------------------------------------------------------------------------------
1 | *.py[cod]
2 |
3 | # C extensions
4 | *.so
5 |
6 | # Packages
7 | *.egg
8 | *.egg-info
9 | dist
10 | build
11 | eggs
12 | parts
13 | bin
14 | var
15 | sdist
16 | develop-eggs
17 | .installed.cfg
18 | lib
19 | lib64
20 |
21 | # Installer logs
22 | pip-log.txt
23 |
24 | # Unit test / coverage reports
25 | .coverage
26 | .tox
27 | nosetests.xml
28 |
29 | # Translations
30 | *.mo
31 |
32 | # Mr Developer
33 | .mr.developer.cfg
34 | .project
35 | .pydevproject
36 |
--------------------------------------------------------------------------------
/modules/clickjacking.py:
--------------------------------------------------------------------------------
1 | from rawweb import *
2 | def main(raw_stream,ssl):
3 | title = [
4 | "Possible Click Jacking", #Test title for report when test is successfull
5 | "No XFO in Response Headers" # Brief description of test how you are manipulating the request(Will help you to repoduce issues)
6 | ]
7 | raw = RawWeb(raw_stream)
8 | final = raw.addheaders({'Fun':'Fun'})#okay
9 | result = raw.fire(ssl)
10 | #result[0] => 200 => Integer
11 | #result[1] => OK => String
12 | #result[2] => Respheaders => dict
13 | #result[3] => body => string
14 | if 'x-frame-options' in result[2]:
15 | # If test result -ve return false
16 | return "FALSE"
17 | #return res.status,res.reason,res_headers,self.craft_res(res.getheaders(),res.read())
18 | #return title,final,result[0],result[1],result[2],result[3]
19 | else:
20 | # If false only send False
21 | #return "FALSE"
22 | return title,final,result[0],result[1],result[2],result[3]
23 |
--------------------------------------------------------------------------------
/modules/samplexsrf.py:
--------------------------------------------------------------------------------
1 | from rawweb import *
2 | def main(raw_stream,ssl): # create a mail subroutine (mandatory)
3 | title = ["Possible XSRF", #Test title for reporting when test is successful
4 | "Removed XSRF token from request"]# Brief description of test how you are manipulating the request(Will help you to reproduce issues)
5 | raw = RawWeb(raw_stream) # Initiate rawweb library
6 | raw.addheaders({'Header1':'Value1'}) # Add new headers to that request
7 | raw.removeheaders(['Referrer']) # Remove Referrer header if exist in raw request
8 | final = raw.removeparameter("auth_token") # final will hold the final request to be fired.(For reporting)
9 | result = raw.fire(ssl)
10 | #result[0] => 200 => Integer
11 | #result[1] => OK => String
12 | #result[2] => Response headers => dictionary
13 | #result[3] => body => string
14 | if 'csrf error' in result[3]:
15 | # Generic CSRF error is in response body. Hence return "FALSE"
16 | return "FALSE"
17 | else:
18 | # As the generic csrf error is not present in body, treat this as suspicious and +ve result.
19 | return title,final,result[0],result[1],result[2],result[3]
20 |
--------------------------------------------------------------------------------
/modules/twitterxsrf.py:
--------------------------------------------------------------------------------
1 | from rawweb import *
2 | def main(raw_stream,ssl):
3 | '''
4 | This Burpy module is specially written to find CSRF vulnerability in Twitter Application.
5 | It has already found few minor and one major CSRF vulnerability in Twitter.
6 | It simply checks whether CSRF token validation is present in Server Side or not by removing token from request and replaying it.
7 | Twitter application always shows a generic error message for CSRF error which is "Your account may not be allowed to perform this action."
8 | If this error is not present in response after removing the token it returns +ve.
9 |
10 | These Twitter Bugs were found using this Burpy Plugin:
11 |
12 | http://www.debasish.in/2013/09/hacking-twitter-for-fun.html
13 | http://www.debasish.in/2013/09/twitter-xsrf-vulnerability-thanks-to.html
14 |
15 |
16 | '''
17 | title = [
18 | "Possible XSRF", #Please don't add