Replicate EasyCSRF with duplicated request

[ehsandeep]

Hi @0ang3el,

Thanks for making burp extension for this, I just installed and tried this, and as you said, it will update the request on the fly while browsing which is good way to do it indeed, but as we know, if application doesn't support the manipulation extension did then web application will be stuck and then we need to disable the ext for the further browsing which is not very practical I think, and I guess this can be done in better way if ext can replicate/clone the request in history tab and do needed manipulation on the duplicate request no the original and highlight that one, in this way we can obsever the all the manuplation in history tab and applicaiton will not be stuck while browsing as well.

let me know what you think about this.

[0ang3el]

Hi @MadaraTech,

First of all thanks for your comment. I'm going to improve extension usability soon. I think that cloning requests can produce False Negatives (when the request creates something and you issue the same request second time, you might get an error, but endpoint might be vulnerable to CSRF). And a better approach is to add whitelisting - when you can whitelist certain URLs, extension will not make modifications for requests to that URLs.

[ehsandeep]

Hi @0ang3el,

Thanks for your response, okay I get it what you mean but still if you doing the modification on the fly there will be the usability issue for sure!

For better use, there is a 2nd way as well, where the user can select multiple request or host and run EasyCSRF from the context menu to scan all those EasyCSRF checks, instead of doing on the fly.

do you think it will be a good idea ?