AutoLogon to a Website and send request defeating CSRF token

Doing all of this in a automated way

Photo by Fatos Bytyqi on Unsplash

Recently at work there was a test case where we needed to send a request to a internal Web App every so often to refresh the internal LDAP database. This is already implemented and required a button to be pressed after logging in to the Web App. Now either you can stay up for few nights and press that button manually or do something to automate this. I choose to automate it :)

Python is best at doing these kind of things and provides modules likes requests and BeautifulSoup to send web request and website scrapping.

Here is how this was done:

1. Figure out the the login URL and the parameters required to login. It was easy — just capture the request in Burp or any other proxy.
2. Figure out the request URL which sends the request (POST) and the parameters. This is also easy — capture the request in Burp and find all the required parameters. Note there may be some hidden parameters which are not usually displayed in the address bar, that is why it is important to note all of them after intercepting the request in Burp.
3. Many sites gives a CSRF tokens when we send requests to them to protect against Cross Site Request Forgery. We need to send back the same token to…