# Bolt | Cross-Site Request Forgery (CSRF) Vulnerablity Scanner **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, documents\ **Created:** [October 19, 2021, 9:40am UTC](https://onehack.st/t/bolt-cross-site-request-forgery-csrf-vulnerablity-scanner/204578 "2021-10-19T09:40:29Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [October 19, 2021, 9:40am UTC](https://onehack.st/t/bolt-cross-site-request-forgery-csrf-vulnerablity-scanner/204578/1 "2021-10-19T09:40:29Z")
# [![Bolt](https://camo.githubusercontent.com/45e01bcb7cbb2f2852abe95ac2a2cb45ad1230352e9aa41b8a59344676a5b34f/68747470733a2f2f692e6962622e636f2f32746e6b4c76742f626f6c742e706e67)](https://github.com/s0md3v/Bolt) Bolt #### A dumb CSRF scanner [![](https://camo.githubusercontent.com/5fb5f6174d9790d64476e66dbd4a703916f5a5784a5fc1658ced26c5659adf5a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f73306d6433762f426f6c742e737667) ](https://github.com/s0md3v/Bolt/releases)[![](https://camo.githubusercontent.com/8d089ad6d8cf1561c8e90fca3185c34a75fdabca8c6cc79fd54c1e3fed7b74a9/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f636f6d2f73306d6433762f426f6c742e737667) ](https://travis-ci.com/s0md3v/Bolt)[![](https://camo.githubusercontent.com/eabfab2b14f074787755641e42374ae172b190004cdec039e0211b343af7c563/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6973737565732d636c6f7365642d7261772f73306d6433762f426f6c742e737667)](https://github.com/s0md3v/Bolt/issues?q=is%3Aissue+is%3Aclosed) [![demo](https://camo.githubusercontent.com/0ddc4c59827b218f369545067dd80b725536a4a2c2a55359e08f96e00fba236a/68747470733a2f2f692e6962622e636f2f6d5474485447502f53637265656e73686f742d323031382d31322d33302d30332d34322d32362e706e67)](https://camo.githubusercontent.com/0ddc4c59827b218f369545067dd80b725536a4a2c2a55359e08f96e00fba236a/68747470733a2f2f692e6962622e636f2f6d5474485447502f53637265656e73686f742d323031382d31322d33302d30332d34322d32362e706e67) ### Important Bolt is in beta phase of development which means there can be bugs. Any production use of this tool discouraged. Pull requests and issues are welcome. I also suggest you to put this repo on watch if you are interested in it. ### Workflow #### Crawling Bolt crawls the target website to the specified depth and stores all the HTML forms found in a database for further processing. #### Evaluating In this phase, Bolt finds out the tokens which aren’t strong enough and the forms which aren’t protected. ##### Comparing This phase focuses on detection on replay attack scenarios and hence checks if a token has been issued more than one time. It also calculates the average [levenshtein distance](https://en.wikipedia.org/wiki/Levenshtein_distance) between all the tokens to see if they are similar. Tokens are also compared against a database of 250+ hash patterns. ##### Observing In this phase, 100 simultaneous requests are made to a single webpage to see if same tokens are generated for the requests. ##### Testing This phase is dedicated to active testing of the CSRF protection mechanism. It includes but not limited to checking if protection exsists for moblie browsers, submitting requests with self-generated token and testing if token is being checked to a certain length. ##### Analysing Various statistical checks are performed in this phase to see if the token is really random. Following tests are performed during this phase - Monobit frequency test - Block frequency test - Runs test - Spectral test - Non-overlapping template matching test - Overlapping template matching test - Serial test - Cumultative sums test - Aproximate entropy test - Random excursions variant test - Linear complexity test - Longest runs test - Maurers universal statistic test - Random excursions test ### Usage Scanning a website for CSRF using Bolt is as easy as doing ```auto python3 bolt.py -u https://github.com -l 2 ``` Where `-u` is used to supply the URL and `-l` is used to specify the depth of crawling. Other options and switches: - `-t` number of threads - `--delay` delay between requests - `--timeout` http request timeout - `--headers` supply http headers #### Credits Regular Expressions for detecting hashes are taken from [hashID](https://github.com/psypanda/hashID). Bit level entropy tests are taken from [highfestiva](https://github.com/highfestiva)’s python implementation of statistical tests. ## GitHub: [https://github.com/s0md3v/Bolt](https://github.com/s0md3v/Bolt) ---
**Author:** ![pluralas\_asd](https://onehack.st/user_avatar/onehack.st/pluralas_asd/32/50582_2.png) [@pluralas\_asd](https://onehack.st/u/pluralas_asd)\ **Post date:** [October 20, 2021, 1:52am UTC](https://onehack.st/t/bolt-cross-site-request-forgery-csrf-vulnerablity-scanner/204578/2 "2021-10-20T01:52:05Z")
CSRF is decreasing over years due to frameworks and browser SOP. i studied SOP and seems like CSRF is not completely dead . last week iam learning CSRF and after reading that according to hackerone repoorts CSRF vuln is decreasing year over year (-34%). first i thought then there is no use of learning this, but thats not how the hacker mindset should be . thanks for sharing . if u are a pentester/bug hunter what is your opinion on CSRF