How to get CSRF token on authorization request with OWASP ZAP in bruteforce mode

Question

I am a new in OWASP ZAP, so I need your help.

I have vulnerability site - DVWA. I am trying to work on token (CSRF) in bruteforce.

When page load I have HTML form with login, password and user-token. Third field are filled by dynamic token (CSRF).

I need to use bruteforce with CSRF token.

1. Receive user_token from loaded page
2. Send form through Fuzzer

As I understand, I need to create script for receiving user_token from loaded page and then run Attak -> Fuzz on authorization link, then select user_token value and add playload script that will fill it on each request.

But I can't find any information on the Internet how to create this script. Can anyone please help me?

Answer 1

Theres actually an easier option when using the fuzzer. Add the 'Anti-CSRF Token Refresher' Message Processor - that will automatically regenerate the token for you :) If its not available then you should just need to tell ZAP about the token name.

Its worth noting that currently we only support CSRF tokens in the body, not in the URL.

Oh, and FYI in the next version of the fuzzer addon this Message Processor will be added by default if we detect a CSRF token in the message being fuzzed :)

Answer 2

This FAQ might help you, it covers dvwa and fuzzing while handling tokens via script: https://github.com/zaproxy/zaproxy/wiki/FAQvulnappdvwa

var SOURCE_URL = "http://localhost/DVWA/vulnerabilities/brute/";
var CSRF_TOKEN_NAME = "user_token";
var REQUEST_URI = new org.apache.commons.httpclient.URI(SOURCE_URL, true);

function processMessage(utils, message) {
    var msg = message.cloneRequest();
    msg.getRequestHeader().setURI(REQUEST_URI);
    var csrfTokenValue = extractInputFieldValue(getPageContent(utils, msg), CSRF_TOKEN_NAME);

    var params = message.getUrlParams();
    replace(params, CSRF_TOKEN_NAME, encodeURIComponent(csrfTokenValue));
    message.getRequestHeader().setGetParams(params);
}

function processResult(utils, fuzzResult){
    return true;
}

function getPageContent(utils, msg) {
    utils.sendMessage(msg);
    utils.addMessageToResults("Refresh " + CSRF_TOKEN_NAME, msg)
    return msg.getResponseBody().toString();
}

function extractInputFieldValue(page, fieldName) {
    var Source = Java.type("net.htmlparser.jericho.Source");
    var src = new Source(page);

    var it = src.getAllElements('input').iterator();

    while (it.hasNext()) {
        var element = it.next();
        if (element.getAttributeValue('name') == fieldName) {
            return element.getAttributeValue('value');
        }
    }
    return '';
}

function replace(params, name, value) {
    var it = params.iterator();

    while (it.hasNext()) {
        var param = it.next();
        if (param.getName() == name) {
            param.setValue(value);
            return;
        }
    }
}