OWASP / OWASP/SecurityShepherd
CSRF lessons don't work well
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
the CSRF lessons are ... interesting. We had real difficulty getting them to fire, despite Burp showing us that increments are happening, but no success keys came up when others incremented the counter. This seems to cover all of the CSRF lessons.
Can we please do some investigation into if the CSRF lessons are currently working, and if so, let's make it a bit easier for users who have submitted a CSRF attack to see their keys
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the CSRF lessons and observing the counter increments with Burp. Investigate why successful increments do not produce success keys across the lessons; done means the lessons reliably recognize submitted CSRF attacks and make the resulting keys easier to find.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100