Module: PWN::SAST::CSRF

Defined in:
lib/pwn/sast/csrf.rb

Overview

SAST Module used to identify indicators of improper CSRF protection. If nothing appears in the report, this may be an indicator of NO CSRF protection.

Class Method Summary collapse

Class Method Details

.authors ⇒ Object

Author(s)

0day Inc. <[email protected]>



54
55
56
57
58
 
# File 'lib/pwn/sast/csrf.rb', line 54

public_class_method def self.authors
  "AUTHOR(S):
    0day Inc. <[email protected]>
  "
end

.help ⇒ Object

Display Usage for this Module



62
63
64
65
66
67
68
69
70
71
 
# File 'lib/pwn/sast/csrf.rb', line 62

public_class_method def self.help
  puts "USAGE:
    sast_arr = #{self}.scan(
      :dir_path => 'optional path to dir defaults to .',
      :git_repo_root_uri => 'optional http uri of git repo scanned'
    )

    #{self}.authors
  "
end

.scan(opts = {}) ⇒ Object

Supported Method Parameters

PWN::SAST::CSRF.scan(

:dir_path => 'optional path to dir defaults to .'
:git_repo_root_uri => 'optional http uri of git repo scanned'

)



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/pwn/sast/csrf.rb', line 18

public_class_method def self.scan(opts = {})
  dir_path = opts[:dir_path]
  git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub

  test_case_filter = "
    grep -ni \
    -e 'csrf' {PWN_SAST_SRC_TARGET} 2> /dev/null
  "

  PWN::SAST::TestCaseEngine.execute(
    test_case_filter: test_case_filter,
    security_references: security_references,
    dir_path: dir_path,
    git_repo_root_uri: git_repo_root_uri
  )
end

.security_references ⇒ Object

Used primarily to map NIST 800-53 Revision 4 Security Controls web.nvd.nist.gov/view/800-53/Rev4/impact?impactName=HIGH to PWN Exploit & Static Code Anti-Pattern Matching Modules to Determine the level of Testing Coverage w/ PWN.



40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/pwn/sast/csrf.rb', line 40

public_class_method def self.security_references
  {
    sast_module: self,
    section: 'MALICIOUS CODE PROTECTION',
    nist_800_53_uri: 'https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=SI-03',
    cwe_id: '352',
    cwe_uri: 'https://cwe.mitre.org/data/definitions/352.html'
  }
rescue StandardError => e
  raise e
end