Why Choose This Project?

Cross-Site Request Forgery (CSRF) is a critical vulnerability listed in the OWASP Top 10 that allows attackers to perform unauthorized actions on behalf of authenticated users. This project combines a CSRF vulnerability scanner and a defense mechanism that helps developers identify and patch vulnerable endpoints automatically. It’s ideal for security-focused portfolios, bug bounty simulations, and enterprise tool development.

What You Get in This Project

• Full source code for scanner and protection tool

• Web interface to test CSRF on web forms and APIs

• Real-time detection of missing CSRF tokens

• Auto-suggestion or patching methods to secure endpoints

• Configurable rules and scan logs

• Admin panel for tracking scan history

• Documentation + setup instructions

• Extendable for DevSecOps pipelines

Technology Stack

How It Works (Flow)

1. Target Submission
   The user/admin enters a target URL or uploads source files for scanning.

2. Scanning Phase
   The scanner parses HTML forms and API calls to detect vulnerable endpoints lacking CSRF tokens or SameSite cookie attributes.

3. Vulnerability Reporting
   A detailed report is generated showing:

   • Form URLs and parameters

   • Whether a CSRF token is present

   • Cookie settings (SameSite=None/Lax/Strict)

   • Security risk level (High/Medium/Low)

4. Patch Suggestion
   The tool offers code snippets for CSRF protection based on chosen backend:

   • Spring Boot: @CsrfToken, CSRF filter

   • Node.js: csurf middleware

   • PHP: custom or Laravel CSRF tokens

5. Hardening Tool (Optional)
   Developers can copy suggested code, or the system auto-patches the source files (Node/PHP-based only) by injecting tokens.

6. Admin Panel
   All scan logs, timestamps, risk levels, and actions taken are stored and viewable in an admin dashboard.

Key Features

• Scans HTML forms and REST API endpoints

• Detects missing CSRF tokens and cookie flags

• Recommends remediation snippets for various languages

• Supports bulk scanning via file upload or URLs

• Token validator using dummy POST requests

• One-click CSRF token generator

• Admin dashboard to manage logs and scans

• Code structured for integration into DevSecOps pipelines